OpenSourceMalware found 16 typosquatted RubyGems packages on August 15, 2026, and tracks the campaign as StubMaker. The packages impersonated popular Ruby dependencies and were used to deliver a Windows information stealer.
The install path is the trap. RubyGems runs an extconf.rb hook during gem installation, so the malicious package can execute code as soon as a developer or CI job installs it. In this case, the chain led to a loader that stole browser credentials, cryptocurrency wallet data, seed phrases, and Telegram data. At least two package names were reclaimed after being yanked, which means removing a bad gem did not permanently retire the name.
For teams that trust package registries and build tools to execute code during dependency install, the exposure lives at the registry layer as much as in the package itself. A resurrected gem name can come back under a new owner and still infect fresh installs, especially on Windows development and build systems.