Sixteen typosquatted RubyGems packages steal browser logins and crypto wallets

Researchers flagged a typosquatting campaign, tracked as StubMaker, that planted sixteen malicious packages on RubyGems to deliver a Windows information stealer. The packages imitate popular Ruby dependencies with clumsy misspellings, betting that a developer will mistype a name during installation. Once installed, the malware harvests browser credentials, cryptocurrency wallets and seed phrases, and Telegram data from the developer's machine. The campaign's name refers to its trick of faking a build toolchain so a malicious install looks like a routine one. It is the latest reminder that open-source package registries remain an easy delivery route for stealers aimed at developers.

Check

Double-check RubyGems dependency names before installing, watch for clumsy misspellings of popular gems, and scan developer machines and CI for the malicious packages if you use Ruby.

Affected

Ruby developers who mistype or fail to verify gem names during installation; the malicious packages install a Windows stealer that takes browser logins, cryptocurrency wallets and seed phrases, and Telegram data.

Fix

Pin and verify dependency names and sources, use lockfiles, prefer tooling that flags typosquats, rotate credentials and wallets on any machine that installed a bad gem, and keep wallets off dev machines.