Supply Chain Attack Targets GitHub Actions via Malicious Ruby Gems and Go Modules

A supply-chain campaign linked to a GitHub account (BufferZoneCorp) distributes malicious Ruby gems (using deceptive names like "knot-...") and Go modules (e.g., github.com/BufferZoneCorp/go-metrics-sdk) that execute during install/initialization to exfiltrate SSH keys, AWS credentials, and GitHub configuration, manipulate CI workflows and dependency resolution (including disabling checksum checks), and establish persistence by appending an SSH public key to authorized_keys; organizations are advised to audit dependencies, rotate exposed credentials, and review CI/CD workflows and environment variables.