A threat actor using the GitHub identity ‘BufferZoneCorp’ published malicious packages across the Ruby and Go open-source ecosystems, embedding credential-harvesting payloads that execute silently during routine dependency installation in CI/CD pipelines. Any development or build environment that installed affected packages before their removal should be treated as presumed compromised pending forensic validation, with AWS credentials, SSH keys, GitHub Actions secrets, and API tokens at risk of exfiltration. The business risk is significant: stolen CI credentials can enable attackers to pivot into cloud infrastructure, poison build artifacts, and establish persistent access across production environments.