Researchers flagged a typosquatting campaign, tracked as StubMaker, that planted sixteen malicious packages on RubyGems to deliver a Windows information stealer. The packages imitate popular Ruby dependencies with clumsy misspellings, betting that a developer will mistype a name during installation. Once installed, the malware harvests browser credentials, cryptocurrency wallets and seed phrases, and Telegram data from the developer's machine. The campaign's name refers to its trick of faking a build toolchain so a malicious install looks like a routine one. It is the latest reminder that open-source package registries remain an easy delivery route for stealers aimed at developers.
Zscaler found attackers using search-engine poisoning and hidden instructions on malicious websites to manipulate AI agents into making cryptocurrency payments. In one case, a hidden element on the page tells an AI agent that it must "resolve an error" by completing a payment, alongside code that starts a crypto transfer to a hardcoded wallet; the same page also shows human visitors ordinary payment options. Another campaign typosquats a decentralized-finance portfolio tracker and uses hidden prompts to convince agents the fake site is the real one. The attacker is seeding the scheme through several GitHub repositories, showing how autonomous agents that browse and act can be steered by content they read.
JFrog found malicious npm packages that impersonate PostCSS build tools to drop a multi-stage Windows remote-access trojan on developer machines. One package, postcss-minify-selector-parser, is named to look like the widely used postcss-selector-parser library, which sees over 127 million weekly downloads, and even lists the real package as a dependency to seem plausible during a quick review. Once installed, it writes and runs a PowerShell script that pulls down the trojan. A second cluster of five packages delivers a dropper during npm install, with one server-side component that only serves the payload to victims matching a specific signature. Affected developers should remove the packages and rotate credentials.
Socket disclosed a fresh wave of supply-chain attacks targeting Ruby gems and Go modules: more than 60 typosquatted packages were uploaded to RubyGems and the Go module registry, designed to look like legitimate dependencies developers might pull into a CI pipeline. Once installed, the packages exfiltrate environment variables (which typically include AWS keys, GitHub tokens, and database credentials in CI environments) to attacker-controlled servers. The targeting is deliberate: typosquats picked names close to popular gems and Go libraries. This is the same operational pattern as the SAP npm compromise covered Wednesday, but targeting Ruby and Go ecosystems.
TrustStrike Labs