Malicious Ruby Gems and Go Modules Impersonate Developer Tools to Steal Secrets and Poison CI
Socket ·
We investigated the GitHub account BufferZoneCorp, which published a cluster of repositories linked to malicious Ruby gems and Go modules. The account is part of a software supply chain campaign targeting developers, CI runners, and build environments across two ecosystems. On the Ruby side, the analyzed gems automate secret theft. They harvest secret-bearing environment variables and read local credential material such as SSH keys, AWS credentials, .npmrc, .netrc, GitHub CLI configuration, and…
Soutenez Socket en consultant la ressource originale
Lire l'article original
