A new software supply chain attack campaign has been observed
using sleeper packages as a conduit to subsequently push malicious
payloads that enabled credential theft, GitHub Actions tampering,
and SSH persistence. The activity has been attributed to the GitHub
account "BufferZoneCorp," which has published a set of repositories
that are associated with malicious Ruby gems and Go modules. As
of
Read more https://thehackernews.com/2026/05/poisoned-ruby-gems-and-go-modules.html
