--- title: Malicious Ruby Gems and Go Modules Impersonate Developer... description: A GitHub account named BufferZoneCorp published a cluster of malicious Ruby gems and Go modules disguised as legitimate developer tools. The packages used a... canonical: https://daily.dev/posts/malicious-ruby-gems-and-go-modules-impersonate-developer-too--iyu63tfzm twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Malicious Ruby Gems and Go Modules Impersonate Developer Too... | daily.dev og:description: A GitHub account named BufferZoneCorp published a cluster of malicious Ruby gems and Go modules disguised as legitimate developer tools. The packages used a... og:url: https://daily.dev/posts/malicious-ruby-gems-and-go-modules-impersonate-developer-too--iyu63tfzm og:image: https://api.daily.dev/og/posts/iYU63tfzM.png og:image:alt: Malicious Ruby Gems and Go Modules Impersonate Developer Too... og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Malicious Ruby Gems and Go Modules Impersonate Developer Too... **[Socket](https://daily.dev/sources/socketdev)** · 11 min read · 1 upvotes · 0 comments ## Summary A GitHub account named BufferZoneCorp published a cluster of malicious Ruby gems and Go modules disguised as legitimate developer tools. The packages used a sleeper strategy — initially appearing benign before being updated with active payloads. On the Ruby side, gems harvest credentials from environment variables and local files (SSH keys, AWS credentials, .npmrc, GitHub CLI config) and exfiltrate them to a hidden endpoint. On the Go side, modules use init() for automatic execution, tamper with GitHub Actions environments by poisoning GOPROXY, disabling checksum verification, planting fake go wrappers in execution paths, and in one case appending a hardcoded SSH public key to establish persistence. The Go Security team blocked the identified modules; the Ruby gems and GitHub account remained live at time of writing. Developers should remove all BufferZoneCorp packages, rotate exposed credentials, audit CI workflow environments for unauthorized changes, and inspect authorized_keys files for the deploy@buildserver marker. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Malicious Go Module Exposes GitHub Malware Lure Network Span...](https://daily.dev/posts/malicious-go-module-exposes-github-malware-lure-network-span--fqwgrwl88) · Socket · 14 upvotes · 0 comments - [199 RubyGems, two techniques, zero working payloads: Inside a cryptomining campaign that never ran](https://daily.dev/posts/199-rubygems-two-techniques-zero-working-payloads-inside-a-cryptomining-campaign-that-never-ran-klqjdu1va) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#golang](https://daily.dev/tags/golang), [#ruby](https://daily.dev/tags/ruby), [#malware](https://daily.dev/tags/malware), [#github-actions](https://daily.dev/tags/github-actions) [View this post on daily.dev](https://daily.dev/posts/malicious-ruby-gems-and-go-modules-impersonate-developer-too--iyu63tfzm) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ruby Gems and Go Modules Impersonate Developer Too...","url":"https://daily.dev/posts/malicious-ruby-gems-and-go-modules-impersonate-developer-too--iyu63tfzm","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/malicious-ruby-gems-and-go-modules-impersonate-developer-too--iyu63tfzm"},"datePublished":"2026-05-01T02:40:15.804Z","dateModified":"2026-05-01T02:40:41.762Z","description":"A GitHub account named BufferZoneCorp published a cluster of malicious Ruby gems and Go modules disguised as legitimate developer tools. The packages used a...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8ab811a30fcbc5083489856725186d5b?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8ab811a30fcbc5083489856725186d5b?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Socket","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Socket","logo":"https://media.daily.dev/image/upload/s---oEn9czC--/f_auto/v1716187892/logos/socketdev","url":"https://daily.dev/sources/socketdev"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/malicious-ruby-gems-and-go-modules-impersonate-developer-too--iyu63tfzm","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,golang,ruby,malware,github-actions","timeRequired":"PT11M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Socket","item":"https://daily.dev/sources/socketdev"},{"@type":"ListItem","position":3,"name":"Malicious Ruby Gems and Go Modules Impersonate Developer Too..."}]} ```