Supply-chain attacksBriefConfirmed by two or more outlets
BufferZoneCorp: Go modules and RubyGems that hijack CI
17 packages (10 Go, 7 `knot-*` gems). `extconf.rb` and `init()` steal SSH, AWS, npm, gh and kube credentials and add a deploy SSH key.
- Disclosed
What happened
- 17 packages (10 Go, 7 `knot-*` gems). `extconf.rb` and `init()` steal SSH, AWS, npm, gh and kube credentials and add a deploy SSH key. Some Go modules were still live on GitHub in Oct 2026.
Sources
- https://gbhackers.com/ruby-gems-and-go-modules-used-in-campaign-github/
- https://cyberxyz.io/blog/bufferzonecorp-go-rubygems-ci-stealer-2026-10-02
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.