Composer Update Is Not Safe Anymore

Short summary

The Laravel-Lang supply chain attack demonstrates how compromised packages can inject malware at autoload time to steal developer credentials and infrastructure secrets. The author describes a defensive workflow using Docker, Composer audit, and Rector/jack to isolate updates and pin exact dependency versions. Composer 2.10 will add automated malware detection and release immutability, but developers must audit proactively before and after updates.

• •Malware in Laravel-Lang was injected via git tags and executed silently at PHP autoload
• •Implement pinned version workflow using jack raise-to-installed to narrow upgrade blast radius
• •Run composer audit before/after updates and follow package maintainers for early breach warnings

Generated with AI, which can make mistakes.