Supply Chain Attack Targets GitHub Actions via Malicious Ruby Gems and Go Modules

A newly discovered software supply chain attack has revealed how threat actors are abusing open-source ecosystems to infiltrate developer environments.

The campaign, linked to a GitHub account named BufferZoneCorp, targets both Ruby and Go ecosystems using malicious packages designed to appear legitimate.

These packages are crafted to compromise developer machines and continuous integration (CI) pipelines, particularly GitHub Actions workflows.

Malicious Ruby Gems Behavior

In the Ruby ecosystem, attackers published deceptive gems using prefixes like “knot-”, mimicking trusted libraries such as knot-activesupport-logger.

These packages were distributed via a RubyGems profile associated with the campaign.

As reported by Socket, the malicious gems exploit Ruby’s native extension build process during installation. This allows them to execute code silently before developers realize any suspicious activity.

Once installed, the packages scan the local system for sensitive data, including SSH private keys, AWS credentials, and GitHub CLI configurations.

The harvested information is encoded into JSON format and transmitted to a remote command-and-control server.

To remain undetected, the malware suppresses errors during execution, ensuring the installation process appears normal and does not raise alerts.

The Go component of the campaign is more advanced and focuses heavily on compromising CI environments.

Malicious Go modules, such as github[.]com/BufferZoneCorp/go-metrics-sdk, are designed to execute automatically when initialized within a project.

These modules manipulate CI workflows by altering environment variables and modifying dependency resolution behavior.

In some cases, they disable checksum verification mechanisms, weakening the integrity checks that normally protect against tampered dependencies.

Additionally, certain modules remove specific dependency entries from project files, allowing attackers to intercept or replace legitimate packages during future builds.

Beyond dependency manipulation, the attackers employ stealthy persistence techniques. Some Go modules insert fake execution wrappers into workflow paths, effectively hijacking command execution.

These wrappers intercept commands, capture sensitive data, and then pass execution to the legitimate binaries to avoid detection.

In more severe cases, the malware establishes long-term access. If initial exfiltration succeeds, the payload appends a hardcoded SSH public key to the system’s authorized_keys file.

This enables attackers to regain access to compromised build servers without needing credentials.

This campaign highlights the increasing sophistication of supply chain attacks targeting developer tools and CI/CD pipelines.

By abusing trust in open-source ecosystems, attackers can achieve widespread impact with minimal initial access.

Security researchers warn that such attacks can lead to mass credential exposure, unauthorized code modifications, and persistent backdoor access across multiple projects.

Organizations are urged to take immediate action to mitigate risks associated with this campaign:

• Audit all dependencies for suspicious or newly introduced packages.
• Remove any packages linked to BufferZoneCorp or similar indicators.
• Rotate all potentially exposed credentials, including API keys and SSH keys.
• Review CI/CD workflows for unauthorized changes, especially in environment variables and execution paths.
• Enforce strict approval processes for adding new dependencies.
• Limit the exposure of sensitive secrets within automated build environments.

As supply chain threats continue to evolve, maintaining strict dependency hygiene and implementing layered security controls are essential to protecting modern development pipelines.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google