Laravel 5.5 index.php file is continuosly hacked

I am using laravel 5.5 for an app. I hosted it on HostGator shared server. It was ok for few months but recently i see that someone can change my index.php file!! I moved my index.php file from public folder to main path as in shared hosting it is not possible to change primary domain's root directroy (HG(HostGator policy). Now every day i have to changed index.php file to show the site ok as everyday i see that it is changed to some large script.

my composer file:

    "require": {
    "php": ">=7.0.0",
    "barryvdh/laravel-dompdf": "^0.8.1",
    "fideloper/proxy": "~3.3",
    "intervention/image": "^2.4",
    "laravel/framework": "5.5.*",
    "laravel/tinker": "~1.0",
    "laravelcollective/html": "~5.0"
},
"require-dev": {
    "barryvdh/laravel-ide-helper": "^2.4",
    "filp/whoops": "~2.0",
    "fzaninotto/faker": "~1.4",
    "mockery/mockery": "~1.0",
    "phpunit/phpunit": "~6.0",
    "symfony/thanks": "^1.0"
},

htaccess file:

# BEGIN custom php.ini PHP54
<IfModule mod_suphp.c>
    suPHP_ConfigPath /home2/talenttechie/public_html
</IfModule>
# END custom php.ini

RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteCond %{REQUEST_URI} !^/\.well-known/acme-challenge/[0-9a-zA-Z_-]+$
RewriteCond %{REQUEST_URI} !^/\.well-known/cpanel-dcv/[0-9a-zA-Z_-]+$
RewriteCond %{REQUEST_URI} !^/\.well-known/pki-validation/[A-F0-9]{32}\.txt(?:\ Comodo\ DCV)?$
RewriteRule ^(.*)$ https://example.com/$1 [R=301,L]


# Hide a specific file
<Files .env>
    Order allow,deny
    Deny from all
</Files>

I changed my cpanel pass and database user and password but nothing happens. Today few mins ago i faced the issue again and i replaced my index.php file with another laravel project's index file. How can i get rid of that problem. Should i change my hosting or it is from the laravel project?

via Chebli Mohamed