Supply‑chain attacks on npm and Laravel packages steal cloud credentials and tokens

Security researchers have identified two coordinated supply‑chain attack campaigns targeting popular software package ecosystems. In the npm ecosystem, attackers compromised at least 31 Red Hat Cloud‑services packages released in June 2026. Malicious code activates in continuous‑integration pipelines, exfiltrating environment variables and npm tokens, and an Android variant was also found stealing authentication and long‑lived refresh tokens.

A separate campaign hit the PHP‑based Laravel‑Lang repository, where more than 700 Git tags were rewritten to include a credential‑stealer. The payload runs automatically when any Laravel application loads the compromised package, harvesting cloud access tokens, browser data, password‑manager vault entries, and CI/CD service credentials. After initial fingerprinting, the malware contacts a command‑and‑control server to download additional code for Windows, Linux and macOS.

Both incidents illustrate how AI‑generated code and over‑privileged CI/CD access are being leveraged to turn seemingly trusted, signed packages into entry points for large‑scale credential theft. Researchers note that only about 40 % of organizations have automated detection for such supply‑chain compromises.