Socket.dev blog
Malicious code in development version of Laravel package linked to Famous Chollima (mentioned in PHP and Composer Support post) · 2026-08-21T17:54:18.276Z
We also identified malicious code in a development version of a legitimate Laravel package linked to Famous Chollima activity. The loader used blockchain infrastructure to retrieve and execute remote code in an apparent developer-targeting campaign.