Sleeper packages in Ruby and Go steal credentials and alter CI workflows, leading to persistent access and data exfiltration.