RubyGems Typosquatting Campaign Steals Dev Credentials

Security researchers flagged a fresh typosquatting campaign targeting RubyGems users with a Windows-based information stealer called StubMaker. On August 15 2026, the firm OpenSourceMalware announced it had identified this activity, noting that malicious packages were being distributed under common names to trick developers into installing them as legitimate dependencies.¹

The attack works by inserting code into commonly installed gems. When a developer runs their local environment or builds CI pipelines, the injected payload captures browser credentials and exfiltrates crypto wallet data, sending it back to an external server while the user remains logged on multiple services—exploiting trust developers place in automated dependency resolution without auditing each library’s provenance.¹

Typosquatting has been known for years; in 2018 Magecart groups injected malicious code into popular JavaScript libraries. The RubyGems package manager’s architecture makes it vulnerable because developers often rely on automated dependency resolution without thoroughly reviewing each library’s source. Attackers modify widely used gems with malware designed for credential theft and crypto‑wallet exfiltration using keylogging combined with form grabbing from browsers when developers are coding locally at home or office environments where they may be accessing sensitive data simultaneously across multiple services via single login credentials shared among them. This opens opportunities not only impacting individual users but also potentially compromising larger organizations if compromised dependencies are pulled down as part of build processes within CI pipelines, leading toward supply‑chain attacks through seemingly innocuous software updates.

Developers are advised to enable multi‑factor authentication on package repositories such as RubyGems or GemHub and review dependencies regularly using tools like TruffleHog, which can scan projects for known vulnerable libraries. Keeping operating systems updated and monitoring local environments for suspicious processes also reduces risk of credential theft by information stealers.¹

OpenSourceMalware continues tracking the threat under the moniker StubMaker, urging organizations to audit gem usage promptly and consider supply chain risk mitigation strategies. This incident underscores the importance of secure dependency management in open‑source ecosystems where typosquatting attacks can compromise both individual developers and larger enterprises through seemingly innocuous software updates.