Security researchers have uncovered a supply chain software compromise involving Packagist repository management where attackers hijacked GitHub Actions workflows to execute cPanel scanning scripts from ephemeral cloud runners. The incident began with unauthorized modifications across ten development versions of PHP and DevOps packages maintained by developer dinushchathurya, according to an analysis published by software supply chain security firm Socket.
Software maintainers and development teams increasingly rely on automated workflows to test, build, and deploy code packages.
Compromise of GitHub Actions Workflows in Packagist Repositories
According to findings detailed by Socket, the attack vector centered on unauthorized access to GitHub repositories managed by the PHP and DevOps developer known online as dinushchathurya. Attackers gained write access to the source code management systems and introduced malicious configuration files into the hidden .github/workflows/ directory.
GitHub Actions uses these YAML-hosted workflow files to trigger automated tasks whenever code changes are pushed or pull requests are opened.
Security analysts observed that the inserted workflows were configured to launch network scanning routines targeting cPanel installations.
Scope of Affected Packages and Developer Impact
The malicious code insertion affected ten distinct development versions across packages associated with the developer’s ecosystem on Packagist, the primary package repository for PHP applications using Composer.
Open-source maintainers face persistent threats from credential stuffing, token leakage, and unauthorized access vectors that bypass standard multi-factor authentication defenses. Security firms recommend that project maintainers routinely audit repository access logs, restrict workflow permissions, and monitor runner activity for unapproved network connections.
Mitigating Automation Abuses in Modern CI/CD Pipelines
Continuous integration and continuous deployment platforms offer immense productivity gains, but they also introduce concentrated points of failure. When an attacker gains control over a project’s automation scripts, they inherit the privileges and computational resources associated with those runners.
Industry best practices for securing CI/CD pipelines involve implementing strict least-privilege permissions for GitHub Actions tokens, requiring manual approval for pull requests that modify workflow files, and utilizing repository secrets management tools to prevent credential exposure. Furthermore, developers are advised to employ software composition analysis tools that verify both package contents and repository integrity before deployment.
As repository administrators continue to clean up affected branches and strengthen access controls, security analysts urge teams to review their recent commit history for any unauthorized changes to automation configurations. Organizations relying on open-source PHP libraries should verify their Composer dependencies against official advisory databases to ensure clean integration states.
Worth a look