---
title: "Malicious Packagist Packages Disguised as Laravel Utilities ..."
url: https://daily.dev/posts/malicious-packagist-packages-disguised-as-laravel-utilities--voiju3dnw
source_url: https://socket.dev/blog/malicious-packagist-packages-disguised-as-laravel-utilities
type: article
source: "Socket"
published: 2026-03-03T18:26:30.212Z
updated: 2026-03-03T18:30:55.308Z
tags: ["security", "php", "malware", "laravel"]
reading_time: 8
upvotes: 19
comments: 1
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Malicious Packagist Packages Disguised as Laravel Utilities ...

**[Socket](https://daily.dev/sources/socketdev)** · 8 min read · 19 upvotes · 1 comments

## Summary

Socket's Threat Research Team discovered a remote access trojan (RAT) distributed through three Packagist packages by threat actor nhattuanbl, disguised as Laravel utilities. The packages nhattuanbl/lara-helper and nhattuanbl/simple-queue contain an identical obfuscated PHP RAT payload in helper.php, while nhattuanbl/lara-swagger acts as a clean-looking vector that silently pulls in lara-helper as a Composer dependency. Once loaded, the RAT connects to a C2 server, supports shell execution, file read/write, screenshots, and system reconnaissance, and runs persistently in the background. The payload uses goto spaghetti, hex/octal string encoding, and randomized identifiers to evade static analysis. Affected hosts should be treated as fully compromised, with all secrets rotated and the payload removed. Key takeaways: transitive dependencies deserve the same scrutiny as direct installs, and dev-master constraints are high-risk in production.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://socket.dev/blog/malicious-packagist-packages-disguised-as-laravel-utilities>

## Community discussion

Top comments from developers on daily.dev.

**@elvis44** · 4 upvotes

> This is an **obfuscated PHP remote-access backdoor** / implant.
>
> Key behaviors visible in your snippet:
>
> - **Calls out to a remote C2 server** via TCP socket:Host: `helper.leuleu.net`Port: `2096`It repeatedly reconnects if it fails (sleep + retry loop).
> - **Encrypted command channel**:Uses `openssl_encrypt/decrypt` with **AES-128-CTR**.Messages are framed with a **4-byte length** + **16-byte IV**, then ciphertext.There’s a hardcoded key string:`$riz07 = "esCAmxUoJkIjTV0n"` (that’s the AES key).
> - **Collects host fingerprint / system info** and sends it:OS type (Windows/Mac/Linux), hostname,...

## Similar posts on daily.dev

- [Laravel Lang packages hijacked to deploy credential-stealing malware](https://daily.dev/posts/laravel-lang-packages-hijacked-to-deploy-credential-stealing-malware-tennbnuyq) · BleepingComputer · 0 upvotes · 0 comments
- [Supply Chain Attack Targets Laravel-Lang Packages with Credential Stealer](https://daily.dev/posts/supply-chain-attack-targets-laravel-lang-packages-with-credential-stealer-jql6noxhz) · Aikido Security · 2 upvotes · 0 comments
- [Laravel-Lang Supply Chain Attack: Every Tag Across Multiple Composer Packages Rewritten to Steal CI Secrets](https://daily.dev/posts/laravel-lang-supply-chain-attack-every-tag-across-multiple-composer-packages-rewritten-to-steal-ci--xhj00bkiy) · StepSecurity · 23 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#php](https://daily.dev/tags/php), [#malware](https://daily.dev/tags/malware), [#laravel](https://daily.dev/tags/laravel)

[View this post on daily.dev](https://daily.dev/posts/malicious-packagist-packages-disguised-as-laravel-utilities--voiju3dnw)