Composer Update Is Not Safe Anymore (opens in new tab)

Saturday morning. I opened Twitter and saw a tweet about the Laravel-Lang packages being compromised. My first reaction was simple: "I don't use that package." Then I opened composer.json on a project I work on and found this in require-dev: "laravel-lang/lang": "^14.8", "laravel-lang/publisher": "^16.8", That changed things. What Actually Happened The attack used laravel-lang packages as the distribution channel. And the sneaky part: the main repository branch looked completely clean. No sus...