Poisoned Ruby Gems and Go Modules Exploit CI Pipelines for Credential Theft

A software supply chain attack campaign uses sleeper packages to push malicious payloads for credential theft, GitHub Actions tampering, and SSH persistence. Ruby gems automate credential theft during install time, harvesting environment variables, SSH keys, AWS secrets, .npmrc, .netrc, GitHub CLI configuration, and RubyGems credentials. Go modules tamper with GitHub Actions workflows by executing through init(), detecting GITHUB_ENV and GITHUB_PATH, setting HTTP_PROXY and HTTPS_PROXY, writing fake go executable into cache directory, and appending to workflow path. The wrapper intercepts go executions while passing control to legitimate binary. Modules also plant fake Go wrappers and add hard-coded SSH public key to ~/.ssh/authorized_keys for remote access.