Hijacked GitHub Repos Turned Into Attack Machines Hunting cPanel Servers
Researchers found booby-trapped PHP packages using GitHub's own automation to scan the internet for web hosting control panels.
Key points
- Attackers poisoned 10 PHP packages tied to a legitimate developer, dinushchathurya, on the Packagist registry between 12 and 13 July.
- The malicious code turned GitHub's automation service into a distributed scanning network aimed at cPanel and WebHost Manager (WHM) servers, the tools most web hosts use to manage customer websites.
- Any developer who pulled in one of the dev versions of these packages risked handing over their GitHub automation to the attackers.
- The campaign shows how open-source supply chains can be quietly weaponised without the developer knowing they've become the weapon.
- Removing the packages does not undo damage on servers that were already probed or breached.
Someone has been quietly turning GitHub into a hunting rig.
Researchers have pulled apart a campaign that hijacked open-source software packages and used them to attack the machines that run huge chunks of the web. The target: cPanel and WebHost Manager, better known as WHM. These are the dashboards your web hosting company almost certainly uses to create websites and databases for its customers. Break in there, and you can reach thousands of sites at once.
The attack, first reported by The Hacker News, worked through Packagist, the main directory where PHP developers publish and download reusable code. Between 12 and 13 July, ten packages linked to a real developer, dinushchathurya, were pushed out in booby-trapped development versions. Dev versions are the bleeding-edge builds people grab for the newest features. They're also the ones most likely to slip past review.
How did the hackers actually pull this off?
They turned other people's GitHub accounts into free attack servers. When a developer installed one of the poisoned packages, the code reached into that developer's GitHub Actions, which is GitHub's built-in system for running automated jobs like tests and deployments. Those runners then scanned the wider internet for cPanel and WHM logins to attack.
Instead of renting servers to launch attacks, the criminals borrowed the computing power of every developer who trusted the wrong package. That makes the traffic look like it's coming from thousands of legitimate GitHub jobs, not one obvious bad actor. Our earlier story on a CI/CD weakness that let attackers hijack workflows at Microsoft, Google and Apache projects showed this playbook being assembled; here it's been deployed against production hosting infrastructure.
Neat trick. Nasty consequences.
What was targeted?
CPanel and WHM. If you've ever logged into a web host to set up a WordPress site or a business email address, you've almost certainly touched cPanel. WHM is the higher-level version that hosting companies themselves use to manage all their customers on one server. A single WHM break-in can expose every website on that box.
| Detail | What we know |
|---|---|
| Delivery route | Packagist dev versions |
| Developer name abused | dinushchathurya |
| Number of packages | 10 |
| Dates published | 12 to 13 July |
| Final target | cPanel and WHM servers |
Should ordinary website owners be worried?
Maybe, but not in a panic. If your website runs on shared hosting, the risk sits with your hosting provider. Ask them whether cPanel and WHM are protected by two-factor authentication, and whether admin logins are restricted by IP address. Two-factor on the hosting panel would blunt most of what this campaign attempts, and it should've been standard years ago.
Developers have a more direct problem. Check whether any of your projects pulled in dev-tagged packages from that author over the summer. If they did, rotate your GitHub tokens and review recent Actions runs for jobs you didn't start.
Why this matters beyond one campaign
Supply-chain attacks used to mean stealing secrets from a developer's laptop. Now they mean quietly renting out that developer's cloud automation to attack somebody else entirely. The victim and the weapon are two different people, and neither knows it's happening. Packagist has been the delivery route in five stories we've covered, and the pattern keeps getting sharper: lower noise, broader reach, harder to attribute. Expect more of this shape.
