Sleeper Packages Turn CI Hosts Into Credential Farms
Sleeper packages can turn a build host into a long-lived compromise, even after the bad package is removed from the registry. The standard response misses the real problem: install-time theft can pull secrets out of CI runners, and sleeper code can wait until later to tamper with workflows or keep SSH access alive.
The campaign used Ruby gems and Go modules published under the GitHub account BufferZoneCorp. The packages were yanked from RubyGems and the Go modules were blocked, but the affected names include knot-activesupport-logger, knot-devise-jwt-helper, knot-rack-session-store, knot-rails-assets-pipeline, knot-rspec-formatter-json, knot-date-utils-rb, knot-simple-formatter, and multiple github.com/BufferZoneCorp modules.
The forward risk is persistence. Already-installed hosts can remain exposed because the packages were built to steal credentials, alter GitHub Actions, and maintain SSH access after activation.