Poisoned Ruby Gems and Go Modules Hijack CI/CD Pipelines for Credential Theft

A new software supply chain attack campaign is actively leveraging ‘sleeper packages’ to compromise CI/CD pipelines. The Hacker News reports that these packages serve as a covert conduit, initially benign, but later pushing malicious payloads. These payloads are designed for credential theft, GitHub Actions tampering, and establishing SSH persistence, giving attackers deep access.

The activity has been attributed by The Hacker News to the GitHub account “BufferZoneCorp.” This account has been observed publishing a series of repositories that host the malicious Ruby gems and Go modules. The implication is clear: developers pulling these dependencies into their projects are unwittingly introducing a ticking time bomb into their build environments.

This isn’t just about a few rogue packages; it’s a direct assault on the integrity of development pipelines. Attackers are exploiting trust in open-source ecosystems to gain a foothold, bypass traditional perimeter defenses, and ultimately exfiltrate sensitive credentials and maintain long-term access. The operational security of your build infrastructure is now a prime target.