TL;DR
This is a Github vulnerability in an exploit class called “Repojacking”.
We recommend everyone to check their Github plugin URLs and rename each and every instance of discoursehosting to communiteq
Background:
We had to rename our company from Discoursehosting to Communiteq in 2019.
If that happens, Github automatically redirects URLs to github repositories to their new location, until someone creates a repository with the same name. At that moment the new repository will take preference.
Github used to mark such repositories as “retired” and prohibited creating a repository with the same name.
A previous exploit is described here. Apparently that fix is no longer effective.
We have filed a Github abuse report and will try to take this repository down with all available means.