RubyGems Abuse Exposes Registry, Not Just Packages
The real break is at the registry control plane. This attack hit RubyGems' own abuse defenses, so checking local gems misses the weak point: whether the service can still block mass signups, junk uploads, and hostile account creation.
RubyGems suspended new registrations after bots pushed more than 500 malicious or junk packages. The registry says existing gems and installs were not compromised, and it is tightening rate limits and enabling WAF protection after reports of attempted XSS and data exfiltration against the service itself.
That leaves a second-order risk: sustained registry abuse can become a staging ground for future supply-chain tampering even if today's packages are removed. The issue is not the current gem corpus, but whether the registry can keep malicious uploads from landing at scale.