A Laravel Nova two-factor authentication package for PHP was tampered with through a hijacked maintainer account, leaving attacker-controlled code inside its branch builds. Projects that pull the package by branch name instead of a tagged release receive files that contact external infrastructure during ordinary development work and fetch a second stage aimed at stored credentials and cryptocurrency wallets. Tagged releases were not altered - exposure is limited to the dev-* branch versions.