A new software supply chain attack campaign has been observed using sleeper packages as a conduit to subsequently push malicious payloads that enabled credential theft, GitHub Actions tampering, and SSH persistence. The activity has been attributed to the GitHub account "BufferZoneCorp," which has published a set of repositories that are associated with malicious Ruby gems and Go modules. As of writing, the packages have been yanked from RubyGems, and the Go modules have been blocked. The names of the libraries are listed below - Ruby: - knot-activesupport-logger - knot-devise-jwt-helper - knot-rack-session-store - knot-rails-assets-pipeline - knot-rspec-formatter-json - knot-date-utils-rb (Sleeper gem) - knot-simple-formatter (Sleeper gem) Go: - github[.]com/BufferZoneCorp/go-metrics-sdk…