A large-scale campaign is leveraging compromised GitHub repositories and GitHub Actions runners as distributed attack infrastructure. The attackers are targeting cPanel and WebHost Manager (WHM) instances by distributing malicious Packagist development versions across 10 packages associated with a legitimate developer. This method allows attackers to utilize trusted CI/CD pipelines for their malicious activities, making detection difficult.