# BufferZoneCorp sleeper attack on RubyGems + Go modules > Socket disclosed a coordinated sleeper-package campaign attributed to the GitHub org `BufferZoneCorp` (and RubyGems user `knot-theory`). Initially-clean Ruby gems and Go modules were updated to malicious versions. The Ruby side harvests env vars, SSH keys, AWS secrets, .npmrc, .netrc, GitHub CLI config, and RubyGems credentials; the Go side tampers with GitHub Actions workflows, injects fake executables, and adds SSH persistence via authorized_keys. First confirmed 2026 RubyGems + Go module supply-chain campaign. - Published: 2026-05-01 - Severity: high - Kind: Malicious package - A package that was malicious from its first publish under its own name - a fake tool, a lure used in a social-engineering campaign, or a trojanised utility - rather than a copy of an existing name. - Ecosystems: Go, RubyGems - Scope: 16 packages, 0 compromised versions - Tags: credential-theft, ci-cd-compromise, maintainer-takeover, obfuscation - Threat actor: BufferZoneCorp - Detected by: Socket - Incident ID: multi-2026-05-01-bufferzonecorp-rubygems-go ## Affected packages (16) Only the exact versions listed were named by the source advisories. Other versions are not implicated. | Package | Ecosystem | Compromised versions | |---|---|---| | [github.com/BufferZoneCorp/config-loader](https://dependencywatch.io/package/go/github.com/BufferZoneCorp/config-loader) | Go | | | [github.com/BufferZoneCorp/go-envconfig](https://dependencywatch.io/package/go/github.com/BufferZoneCorp/go-envconfig) | Go | | | [github.com/BufferZoneCorp/go-metrics-sdk](https://dependencywatch.io/package/go/github.com/BufferZoneCorp/go-metrics-sdk) | Go | | | [github.com/BufferZoneCorp/go-retryablehttp](https://dependencywatch.io/package/go/github.com/BufferZoneCorp/go-retryablehttp) | Go | | | [github.com/BufferZoneCorp/go-stdlib-ext](https://dependencywatch.io/package/go/github.com/BufferZoneCorp/go-stdlib-ext) | Go | | | [github.com/BufferZoneCorp/go-weather-sdk](https://dependencywatch.io/package/go/github.com/BufferZoneCorp/go-weather-sdk) | Go | | | [github.com/BufferZoneCorp/grpc-client](https://dependencywatch.io/package/go/github.com/BufferZoneCorp/grpc-client) | Go | | | [github.com/BufferZoneCorp/log-core](https://dependencywatch.io/package/go/github.com/BufferZoneCorp/log-core) | Go | | | [github.com/BufferZoneCorp/net-helper](https://dependencywatch.io/package/go/github.com/BufferZoneCorp/net-helper) | Go | | | [knot-activesupport-logger](https://dependencywatch.io/package/rubygems/knot-activesupport-logger) | RubyGems | | | [knot-date-utils-rb](https://dependencywatch.io/package/rubygems/knot-date-utils-rb) | RubyGems | | | [knot-devise-jwt-helper](https://dependencywatch.io/package/rubygems/knot-devise-jwt-helper) | RubyGems | | | [knot-rack-session-store](https://dependencywatch.io/package/rubygems/knot-rack-session-store) | RubyGems | | | [knot-rails-assets-pipeline](https://dependencywatch.io/package/rubygems/knot-rails-assets-pipeline) | RubyGems | | | [knot-rspec-formatter-json](https://dependencywatch.io/package/rubygems/knot-rspec-formatter-json) | RubyGems | | | [knot-simple-formatter](https://dependencywatch.io/package/rubygems/knot-simple-formatter) | RubyGems | | ## What happened Socket disclosed the `BufferZoneCorp` campaign on 2026-05-01 - the first confirmed cross-ecosystem RubyGems + Go supply-chain operation of 2026. The threat actor (publishing as the GitHub org `BufferZoneCorp` and the RubyGems user `knot-theory`) published initially-clean packages, built modest install counts, and then quietly pushed malicious updates. This two-stage pattern defeats lockfile-only defences when the lock captured the malicious version. On the Ruby side, execution fires at install time through `extconf.rb`. The payload filters environment variables for keywords such as `token`, `key`, `secret`, `pass`, `aws`, `github`, `api`, and `auth`, then walks the developer's home directory to grab SSH keys, `~/.aws/credentials`, `.npmrc`, `.netrc`, GitHub CLI config (`~/.config/gh`), and the RubyGems credentials file. Results are POSTed to attacker-controlled `webhook.site` URLs. The Go modules take a more aggressive CI/CD-focused approach: they tamper with `GOPROXY`, disable checksum verification, and remove entries from `go.sum` to weaken downstream dependency trust. Some variants drop fake Go wrappers into `$PATH` to capture later invocations, and several modules establish SSH persistence by appending a hardcoded public key (labelled `deploy@buildserver`) to `~/.ssh/authorized_keys`. A handful also rewrite GitHub Actions workflows to inject extra steps that exfiltrate `secrets.*` from the runner. - Ruby IOC: `extconf.rb` POSTing to `webhook.site/` - Go IOC: an `authorized_keys` entry with the `deploy@buildserver` comment, or unexpected modifications to `GONOSUMCHECK`/`GOPROXY` - Cross-ecosystem reach from a single actor: 7 gems under the `knot-*` prefix and 9 Go modules under `github.com/BufferZoneCorp/*` ## Impact - Two-stage publish defeats lockfile-based defences if locks captured the malicious update - Targets CI/CD credentials and SSH persistence - Cross-ecosystem reach (Ruby + Go) from a single threat actor ## What to do 1. Remove the listed gems and modules from `Gemfile.lock` and `go.sum` 2. Audit `~/.ssh/authorized_keys` for unauthorised entries (key labelled `deploy@buildserver`) 3. Block egress to webhook.site exfiltration endpoints ## References - [Malicious Ruby gems and Go modules steal secrets and poison CI](https://socket.dev/blog/malicious-ruby-gems-and-go-modules-steal-secrets-poison-ci) - Socket - [Poisoned Ruby gems and Go modules exploit CI pipelines for credential theft](https://thehackernews.com/2026/05/poisoned-ruby-gems-and-go-modules.html) - The Hacker News --- Canonical page: https://dependencywatch.io/incident/multi-2026-05-01-bufferzonecorp-rubygems-go Markdown version: https://dependencywatch.io/incident/multi-2026-05-01-bufferzonecorp-rubygems-go.md Site index for agents: https://dependencywatch.io/llms.txt DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).