The knot-rack-session-store package version 1.0.2 is a malicious RubyGem that belongs to a cluster of malicious packages targeting RubyGems and Go BufferZoneCorp ecosystems. Its malicious behavior includes credential theft, unauthorized SSH access setup, and manipulation of build and workflow environment variables. This package is flagged by multiple security sources including OpenSSF and Google Open Source Security. There is no CVSS score or vendor advisory indicating a patch or fix. The package is not a cloud service, and no known exploits in the wild have been reported.

If used, this malicious package can compromise system security by stealing sensitive credentials, enabling unauthorized SSH access, and altering environment variables critical to build and workflow processes. This can lead to unauthorized access, data exfiltration, and potential disruption or compromise of development pipelines.

No official patch or remediation guidance is provided. Users should immediately remove version 1.0.2 of knot-rack-session-store from their environments and avoid using this package. Verify dependencies and supply chain integrity to ensure no malicious versions are present. Monitor for any unauthorized SSH keys or environment changes that may have been introduced. Check vendor or security advisories for updates or further guidance.