Composer 2.10 is out.
Native malware filtering via @AikidoSecurity, enabled by default on @Packagist. Plus a unified config.policy framework, deprecated source fallback, and wildcards in --with.
#php#phpc#composerphp
🚨 Supply chain attack on the Laravel Lang organization:
700+ historical versions across multiple community-maintained Laravel Lang packages were compromised with an RCE backdoor, including:
laravel-lang/lang
laravel-lang/http-statuses
laravel-lang/attributes
Laravel-Lang/actions
The payload targets cloud creds, CI/CD secrets, Kubernetes tokens, Vault, browser data, password managers, SSH keys, and more.
🚨 Ongoing supply chain attack on Composer packages! We just found multiple laravel-lang/* packages compromised on Packagist (lang, http-statuses, attributes). Payload runs at autoload time. At least 50 package versions were compromised.
If you installed a compromised version, the malware already executed. Pin to a clean COMMIT (not version) and rotate secrets immediately.
If your lockfile already had an older commit from before today, you are safe. But you should not update at the moment.
We're super pumped to announce that @Geocodio have sponsored The Vibes and some of the team will be in attendance! 🎉
Why not come join them?
https://t.co/VKGT5whhyf
I've started a new AI podcast with @IanLandsman!
It's a tight news roundup, livestreamed weekly.
@MostlyTechPod will remain the ride-along / banter / hows-your-father show, but @TokenTownPod will be straight to the point!
Get it while it's hot