CuraSec

tag: Rubygems · 2 items

Act 16 Typosquatted RubyGems Packages Deploy StubMaker Info-Stealer
2026-08-19 · The Hacker News · source ↗ #supply-chain#rubygems#info-stealer
  • Engineer — Act: Active malicious packages in a public registry represent a live supply-chain threat. Audit all Gemfile.lock files and CI build logs for the named packages (ubnuler, ubnlder, ri18nr, reaker, rakier, orakw, joxn); rotate browser credentials and secrets from any Windows developer or runner machines where matches are found.
  • SOC/IR — Act: Sweep Windows developer workstations for StubMaker stealer artifacts and search CI/CD build logs for gem install activity referencing the named packages since August 15, 2026; focus on credential and crypto wallet exfiltration indicators on affected hosts.
  • Leader — Plan: Confirm Ruby usage across engineering teams and verify that current dependency scanning controls would detect typosquatted packages before they reach production or developer machines; this campaign is a concrete prompt to close any gap in software supply chain policy this quarter.
Act archived SleeperGem: Three Malicious RubyGems Target Developer Machines
2026-07-20 · The Hacker News · source ↗ #supply-chain#rubygems#malware
  • Engineer — Act: If you have Ruby projects, audit all dependency trees for git_credential_manager versions 2.8.0–2.8.3 and Dendreo versions 1.1.3–1.1.4; remove immediately and treat any developer machine that installed them since July 18 as potentially compromised.
  • SOC/IR — Act: Hunt for installations of these specific gem versions in developer endpoint EDR telemetry and CI/CD build logs since July 18, 2026; any confirmed install warrants an assume-breach sweep of that machine for secondary payload execution.
  • Leader — Plan: If your organization has Ruby developers, direct the engineering team to audit for these packages and assess developer workstation exposure this week — credential-stealing supply chain hits on dev machines can pivot to production secrets.