Fake Laravel Packages on Packagist Deploy Cross-Platform RAT via Supply Chain Compromise — Threadlinqs Intelligence
As of 2026-05-30, Fake Laravel Packages on Packagist Deploy Cross-Platform RAT via Supply Chain Compromise is a high-severity supply chain threat attributed to nhattuanbl (N/A), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 17 indicators of compromise.
Threat ID: TL-2026-0190 · Severity: HIGH · CVSS: 8.8 · Status: DORMANT · Category: SUPPLY_CHAIN
Attribution: nhattuanbl · N/A · UNKNOWN
Threat actor nhattuanbl published six PHP packages to Packagist impersonating Laravel utilities, with three packages (lara-helper, simple-queue, lara-swagger) embedding or transitively pulling in an
A supply chain attack targeting the PHP developer ecosystem was discovered by Socket.dev researcher Kush Pandya in March 2026. The threat actor operating under the Packagist username 'nhattuanbl' (email: nhattuanbl.woop@gmail.com, account registered December 2015) published six packages between June and December 2024 that masqueraded as legitimate Laravel utility libraries. Three of the six packages served as clean credibility builders: nhattuanbl/lara-media, nhattuanbl/snooze, and nhattuanbl/syslog. Two packages — nhattuanbl/lara-helper (37 installs) and nhattuanbl/simple-queue (29 installs) — contained an identical malicious payload embedded in src/helper.php. A sixth package, nhattuanbl/lara-swagger (49 installs), contained no direct malicious code but declared nhattuanbl/lara-helper as a hard Composer dependency, ensuring the RAT was installed transitively whenever developers required the swagger utility. The malicious file src/helper.php is 27,340 bytes delivered as a single continuous line after the opening <?php tag. It employs three distinct obfuscation layers: (1) control flow shattered into hundreds of randomized goto jumps with meaningless labels like tc0pE and IlaiV, (2) every string literal including domain names, command names, and file paths encoded using hexadecimal or octal escape sequences, and (3) all variable and function names replaced with randomly generated strings. Once loaded via Composer autoloading, the payload connects to a command-and-control server at helper.leuleu.net on port 2096 using PHP's stream_socket_client() function over raw TCP. All traffic between the RAT and C2 is encrypted using AES-128-CTR with a hardcoded 16-byte key (esCAmxUoJkIjTV0n). The RAT transmits a full system profile including hostname, OS version, user permissions, and a machine unique ID, then enters a persistent command loop retrying the connection every 15 seconds if disconnected. The RAT probes disable_functions and selects the first available execution method from: popen, proc_open, exec, shell_exec, system, passthru. Supported C2 commands include: ping (heartbeat every 60 seconds), info (system reconnaissance), cmd (shell command execution), powershell (PowerShell command execution), run (background shell execution), screenshot (using imagegrabscreen()), download (arbitrary file reading), upload (file writing with rwx permissions), and stop (socket termination). The C2 domain helper.leuleu.net resolves to 173.230.142.118, hosted on Linode (Akamai Technologies) infrastructure in the United States. The parent domain leuleu.net is protected by Cloudflare DNS. At the time of public disclosure, the C2 server was non-responsive, though the RAT's persistent retry loop means compromised hosts will reconnect automatically if the server comes back online. Any Laravel application that installed these packages has a persistent RAT running within the same PHP process as the web application, with access to environment variables, database credentials, API keys, and secrets stored in .env files. The RAT is cross-platform, functioning on Windows, macOS, and Linux systems. The packages required ext-mongodb, ext-openssl, deerdama/console-zoo-laravel, and ircmaxell/random-lib as dependencies. The malicious packages were flagged by Aikido security scanner and remain documented on Packagist with malware warnings.
---
**Revalidated on 2026-03-12**
Eight days after initial public disclosure, the nhattuanbl supply chain attack remains an active and unresolved threat. Despite Socket.dev's takedown request submitted on March 3 and broad media coverage on March 4, the three weaponized packages (lara-helper, simple-queue, lara-swagger) remain listed on Packagist.org. The only mitigation is an Aikido security scanner flag displaying a prominent 'Versions of this package have been flagged as malware by Aikido' warning on each package's Packagist page -- but the packages have not been delisted or made uninstallable. No official Composer security
Weaknesses (CWE)
CWE-506, CWE-829, CWE-912
Target sectors: technology, software-development, saas, e-commerce, financial, healthcare
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 17 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1587, T1583, T1583, T1585, T1195, T1059, T1059, T1546, T1027, T1027