Attackers have weaponized compromised GitHub repositories and Actions runners to orchestrate a large-scale campaign targeting cPanel and WebHost Manager (WHM) servers. The campaign exploited 10 malicious Packagist packages connected to a legitimate PHP and DevOps developer account, dinushchathurya, between July 12-13.

The threat actors injected malicious code into development versions of these packages. When developers pulled these versions through normal dependency management workflows, the malicious payloads executed within GitHub Actions runners. These runners then became part of a distributed attack infrastructure targeting cPanel and WHM instances.

cPanel and WHM are critical control panel systems used by web hosting providers and server administrators to manage hosting environments. Compromising these systems grants attackers administrative access to hosted websites and server configurations, enabling data theft, website defacement, malware deployment, and credential harvesting at scale.

The attack chain leverages the trust developers place in package repositories and automation tools. By poisoning development-stage packages, attackers bypass many security checks that target production releases. GitHub Actions runners execute with broad network permissions by default, making them ideal jumping-off points for lateral movement toward hosting infrastructure.

This campaign reflects a broader trend of supply chain attacks targeting development tools and package repositories. Previous attacks have exploited similar vectors through npm, PyPI, and RubyGems to distribute malware and establish command-and-control infrastructure.

Organizations hosting applications on cPanel and WHM servers should audit their GitHub Actions configurations immediately. Restrict Actions runner permissions to minimum necessary levels. Review Packagist package dependencies for unexpected development versions in production environments. Implement code signing verification for all external dependencies. Monitor GitHub audit logs for suspicious Actions execution patterns and unusual network connections from runners.

Developers maintaining open-source packages should enable two-factor authentication on accounts, rotate API tokens regularly, and monitor repository access logs