Cybersecurity experts have identified a series of malicious PHP packages on Packagist, the popular PHP package repository, that are targeting developers through Laravel projects. These packages, masquerading as legitimate Laravel utilities, function as conduits for a cross-platform remote access trojan (RAT) capable of infecting Windows, macOS, and Linux environments.
The packages flagged by researchers include nhattuanbl/lara-helper, nhattuanbl/simple-queue, and nhattuanbl/lara-swagger. While nhattuanbl/lara-swagger does not embed malicious code directly, it declares nhattuanbl/lara-helper as a Composer dependency, causing the RAT to be installed when developers add the package to their projects. Despite the security risk, these packages remain available for download on Packagist, highlighting the dangers of installing unverified open-source components.
According to security researcher Kush Pandya, the malicious packages employ advanced techniques to evade detection. Files such as src/helper.php use control flow obfuscation, encode domain names and command strings, and randomize variable and function names, making static analysis challenging. Once executed, the RAT establishes a connection with a command-and-control (C2) server hosted at helper.leuleu[.]net:2096, transmitting system reconnaissance data and awaiting further instructions.
The malware provides operators with extensive control over compromised systems. Its supported commands include ping for heartbeat signals, info to collect system data, cmd and powershell to execute commands, run for background execution, screenshot for screen capture, download and upload to manipulate files, and stop to terminate operations. The RAT automatically selects available PHP functions for shell execution, including popen, proc_open, exec, shell_exec, system, or passthru, ensuring resilience even against common PHP hardening configurations.
This cross-platform capability makes the malware particularly dangerous for developers working in heterogeneous environments. Attackers can remotely access, manipulate, and exfiltrate sensitive information from servers or development machines, potentially affecting production systems and confidential data. The inclusion of Windows-specific PowerShell commands further extends its reach, enabling full control across operating systems.
The attack highlights a growing concern in software supply chain security. Open-source packages, while widely used for accelerating development, can introduce vulnerabilities when malicious actors upload deceptive components. Developers are advised to verify package authenticity, review dependency chains carefully, and employ security tools to scan for suspicious code before installation.
Security experts recommend using Composer security checks, maintaining an internal registry of trusted packages, and monitoring network traffic for unusual outbound connections. Early detection is critical, as the RAT is capable of executing arbitrary commands and bypassing standard security measures.
This incident serves as a warning for the developer community, emphasizing the importance of supply chain vigilance and proactive security practices when using open-source software in production environments.
