Poisoned Ruby Gems and Go Modules Exploit CI Pipelines for Credential Theft

Security researchers have uncovered a sophisticated supply chain attack targeting developers through poisoned Ruby Gems and Go Modules designed to steal credentials from continuous integration and deployment pipelines. The malicious packages exploit the automated nature of CI/CD systems, where they run with elevated privileges and have access to sensitive authentication tokens and environment variables. This attack highlights the growing threat to software supply chains, as compromised developer tools can provide attackers with a direct pathway to production systems and cloud infrastructure.