Tag
Composer: Arbitrary File Write via Malicious Transitive Package Name
3 TTPs 1 CVEA critical vulnerability, CVE-2026-59948, in Composer allows for arbitrary file write outside the project's vendor directory when processing a maliciously crafted package from an untrusted third-party repository during `install` or `update` operations, enabling code execution.
Laravel Lang Packages Hijacked in Credential-Stealing Supply Chain Attack
2 rules 4 TTPs 1 IOCAttackers compromised Laravel Lang packages by rewriting GitHub tags, distributing a credential-stealing malware targeting cloud credentials, secrets, keys, browser data, and cryptocurrency wallets across Windows, Linux, and macOS systems.
GitHub Actions GITHUB_TOKEN Disclosure via Composer Validation Failure
2 rules 1 TTPComposer leaks GitHub OAuth tokens in GitHub Actions logs if they do not match the expected format due to a validation regex, leading to potential unauthorized access.
Composer Command Injection via Malicious Perforce Repository
2 rules 1 TTPComposer is vulnerable to command injection via a malicious Perforce repository due to improper escaping of user-supplied Perforce connection parameters, potentially leading to arbitrary command execution in the context of the user running Composer.