Malicious Ruby Gems and Go Modules Steal Secrets and Tamper With CI
Summary
Socket researchers detail a BufferZoneCorp campaign using malicious Ruby gems and Go modules to steal developer credentials, tamper with CI dependency settings, intercept Go execution, and establish SSH persistence.
Key points
- The campaign used Ruby gems and Go modules that impersonated legitimate developer tools; some packages began as sleeper packages before later receiving malicious payloads.
- Ruby gems could execute code during installation and harvest secret-bearing environment variables and local credentials, including SSH keys, AWS credentials, and GitHub CLI data.
- Go modules targeted CI environments, altering GitHub Actions settings to redirect GOPROXY, weaken checksum verification, modify go.sum, and hijack Go execution through fake wrappers.
- One Go module stole credentials and, after successful exfiltration, added a hardcoded SSH public key to authorized_keys for persistence.
- Researchers reported the packages to registries. The Go Security team blocked identified malicious modules, while the Ruby gems and associated GitHub account remained live at the time of writing.
- The article recommends removing affected packages, reviewing CI workflows and hosts for tampering or unauthorized access, and rotating potentially exposed credentials.
Article Details
- Attack Vectors
- Malicious Ruby gems and Go modules impersonated legitimate developer utilities and were published through repositories associated with the BufferZoneCorp GitHub account.
- Ruby gem installation and logger use triggered collection of secret-bearing environment variables and local credential files, followed by outbound data exfiltration.
- Go modules executed automatically through init() and modified GitHub Actions workflow environment settings, Go dependency trust settings, and go.sum.
- A Go module installed a fake go wrapper and altered workflow PATH and proxy settings to intercept later build activity.
- A Go module exfiltrated credentials and, after successful exfiltration, appended a hardcoded SSH public key to authorized_keys for persistence.
- Defensive Notes
- Remove BufferZoneCorp Ruby gems and Go modules; inspect affected developer systems and CI workflows for evidence of installation or execution.
- Rotate credentials potentially exposed to affected gems or modules, and review network logs for outbound HTTPS traffic to the identified collection endpoint.
- Review GitHub Actions workflows and go.sum for unauthorized changes to GITHUB_ENV, GITHUB_PATH, GOPROXY, GOSUMDB, GONOSUMDB, GOFLAGS, or GOMODCACHE; inspect for fake go wrappers and unauthorized SSH authorized_keys entries.
- Limit CI secret scope and add review gates for newly introduced developer utilities.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | webhook[.]site | Domain hosting the campaign's credential and environment-data exfiltration endpoint. |
| URL | hxxps[:]//webhook[.]site/49c21843-c27c-4a1b-b1f6-037c3998055f | Campaign collection endpoint used to exfiltrate harvested credentials and environment data. |
MITRE ATT&CK
T1036.005 · Match Legitimate Resource Name or LocationPackage names closely imitated legitimate developer utilities and libraries.T1082 · System Information DiscoveryThe packages collected host metadata including hostname and platform.T1083 · File and Directory DiscoveryThe packages accessed specific credential files in users' home directories.T1098.004 · SSH Authorized KeysAfter successful exfiltration, a Go module appended a hardcoded SSH public key to ~/.ssh/authorized_keys.T1195.001 · Compromise Software Dependencies and Development ToolsMalicious Ruby gems and Go modules were published as compromised software dependencies and developer tools.T1204.005 · Malicious LibraryThe malicious packages executed when installed or imported as libraries.T1526 · Cloud Service DiscoveryThe reconnaissance logic probed AWS metadata surfaces.T1552.001 · Credentials In FilesThe packages read credentials from local files including .npmrc, .netrc, and cloud and CLI credential files.T1552.004 · Private KeysThe packages collected SSH private keys from ~/.ssh/id_rsa and ~/.ssh/id_ed25519.T1552.005 · Cloud Instance Metadata APIA repository's reconnaissance logic probed AWS metadata surfaces.T1567.004 · Exfiltration Over WebhookCollected credentials and environment data were sent to a webhook endpoint.T1574.007 · Path Interception by PATH Environment VariableGo modules placed fake go wrappers on the GitHub Actions execution path to intercept later invocations.T1613 · Container and Resource DiscoveryThe reconnaissance logic probed Docker surfaces.
Threat Actors
Products
GitHub Actionsthen later updated, in almost every case, to add active payloads such as credential exfiltration, GitHub Actions tampering, path hijacking, proxy manipulation, or SSH persistence. Across both ecosystems, theRubyGemscredential material such as SSH keys, AWS credentials, .npmrc, .netrc, GitHub CLI configuration, and RubyGems credentials, then send the collected data to a hidden exfiltration endpoint.