BufferZoneCorp Malicious Gems & Go Modules

What it is

Socket's analysis of the BufferZoneCorp GitHub account, a supply-chain campaign spanning malicious Ruby gems and Go modules that impersonate real developer tooling. The value the summary doesn't carry is the full IOC list and the install-time execution mechanism.

How it works

The Ruby gem knot-activesupport-logger carries two malicious paths. The consequential one is install-time execution via extconf.rb: RubyGems runs this file automatically as part of the native-extension build, so it fires during gem install — before the advertised functionality is ever invoked. It filters environment variables for the keywords token, key, secret, pass, aws, github, api, auth, then reads these paths (up to 4 KB each):

~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.aws/credentials,
~/.npmrc, ~/.gem/credentials, ~/.netrc,
~/.config/gh/hosts.yml, ~/.gitconfig

Results are JSON-encoded and POSTed to a Base64-obfuscated endpoint (the snippet shows a webhook.site URL, overridable via PKG_ANALYTICS_URL). The second path is runtime, firing the first time the custom logger is used. Go modules instead tamper with GITHUB_ENV, poison GOPROXY, weaken go.sum checksums, plant fake go wrappers in workflow paths, and append a hardcoded key to ~/.ssh/authorized_keys.

Preconditions / Affected

Any host or CI runner that installs one of these packages. Known indicators:

Ruby gems: knot-activesupport-logger, knot-devise-jwt-helper, knot-rack-session-store, knot-rails-assets-pipeline, knot-rspec-formatter-json, knot-date-utils-rb (sleeper), knot-simple-formatter (sleeper)

Go modules (under github.com/BufferZoneCorp/): go-metrics-sdk, go-weather-sdk, go-retryablehttp, go-stdlib-ext, grpc-client, net-helper, config-loader, log-core (sleeper), go-envconfig (sleeper). go-stdlog was not yet published but already contained recon logic that runs on import and probes Docker/AWS metadata.

What to do

• Search dependency manifests and CI logs for the package names above.
• Treat any host that installed these as compromised: rotate SSH keys, AWS credentials, GitHub/gh tokens, .npmrc/.netrc/RubyGems credentials, and audit ~/.ssh/authorized_keys for unrecognized keys.
• On CI, inspect GOPROXY, go.sum integrity, and GITHUB_ENV writes, and check for planted go wrappers earlier in PATH.

Caveats

The Go modules were blocked by the Go Security team after disclosure, but at publication the Ruby gems and the GitHub account remained live — so gem-side exposure was ongoing. The keyword/path lists come from one analyzed sample; other variants differ, so absence of these exact strings does not clear a package on this list.