Ruby Gems and Go Modules Impersonate Dev Tools to Steal Secrets and Poison CI
Malicious packages impersonating legitimate developer tools have been discovered in both the RubyGems and Go module ecosystems, designed to steal user secrets and compromise continuous integration (CI) environments. These packages use sophisticated techniques such as dependency confusion and code obfuscation to evade detection while propagating across platforms. The attack follows a similar pattern previously observed in npm and now extends to Packagist, where a malicious Intercom PHP package leverages Composer plugin execution to spread and harvest credentials.
Opening excerpt (first ~120 words) tap to expand
.css-14sa009{display:-webkit-box;display:-webkit-flex;display:-ms-flexbox;display:flex;-webkit-flex-direction:column;-ms-flex-direction:column;flex-direction:column;height:var(--chakra-sizes-full);}.css-mezi7s{display:-webkit-box;display:-webkit-flex;display:-ms-flexbox;display:flex;-webkit-align-items:center;-webkit-box-align:center;-ms-flex-align:center;align-items:center;background:var(--chakra-colors-gray-950);--bg-currentcolor:var(--chakra-colors-gray-950);-webkit-flex-direction:column;-ms-flex-direction:column;flex-direction:column;height:180px;margin-bottom:var(--chakra-spacing-2);overflow:hidden;place-content:center;}.css-1phd9a0{object-fit:cover;}.css-x8iw57{display:-webkit-box;display:-webkit-flex;display:-ms-flexbox;display:flex;-webkit-flex-direction:column;-ms-flex-direction:c…
Excerpt limited to ~120 words for fair-use compliance. The full article is at Socket.
Discussion
0 commentsMore from Socket
