A new software supply chain attack campaign has been observed using sleeper packages as a conduit to subsequently push malicious payloads that enabled credential theft, GitHub Actions tampering, and SSH persistence.
The activity has been attributed to the GitHub account "BufferZoneCorp," which has published a set of repositories that are associated with malicious Ruby gems and Go modules. As of
source https://thehackernews.com/2026/05/poisoned-ruby-gems-and-go-modules.html
Friday, May 1, 2026
Poisoned Ruby Gems and Go Modules Exploit CI Pipelines for Credential Theft
.png){kind=avatar}
Subscribe to:
Post Comments (Atom)
No comments:
Post a Comment
please do not enter any spam link in the comment box