16 Fake RubyGems Steal Passwords and Crypto Wallets Under the Guise of a Build

Researchers at OpenSourceMalware have reported a new typosquatting campaign in the RubyGems ecosystem, targeting Windows. The activity, discovered on August 15, 2026, is being tracked under the name StubMaker. In total, 16 malicious packages were published — among them ubnuler, ri18nr, reaker, rakier, orakw, joxn, activesupmport, brumdler and others. By the time of publication all of them had already been removed from the repository.

According to researcher Paul McCarty, the malware harvests credentials from browsers, crypto wallets, seed phrases and Telegram data. The authors didn't go to any great lengths about it: instead of the carefully crafted SEO typos seen with other attackers, here there are simply clumsy misspellings of popular dependencies' names.

The weak spots in RubyGems itself

OpenSourceMalware co-founder Jenn Gile notes that the campaign was aided by Ruby's “poor architectural decisions.” First, once a package name is freed up after all versions are pulled, anyone can claim it. In the cases of brumdler and brundlef, the attackers seized names that had previously belonged to another account: what was supposed to “die forever” came back to life and went on infecting users. Whenever the next malicious gem was removed, the attacker set up a new owner account and republished the package under the same name.

Second, the “Author” field isn't verified in any way. The packages were attributed to various fictitious authors (Riley Miller, Alex Davis and others) to make them look unrelated to one another, even though they were published from the very same accounts.

A fake build instead of a real one

Execution is provided by the extconf.rb hook, which in Ruby is normally used to configure native extensions and runs automatically when a package is installed. Hence the name StubMaker: the malware compiles nothing but instead generates a Makefile with empty targets and stub scripts that merely return “success.” While the build phase reports a clean result, the install hook quietly downloads a 22-megabyte Rust loader from GitHub, which in turn launches a Go stealer.

The stealer itself bypasses Google's app-bound encryption protection and pulls data from Chromium-based browsers — Chrome, Edge, Brave, Opera, Vivaldi, Yandex and others. It collects history and card numbers, searches for crypto wallets and seed phrases, grabs Telegram Desktop data and system information, and then determines the victim's public IP via api.ipify.org. All of this is packed into a password-protected ZIP, uploaded to Gofile, and the attacker receives the link over unencrypted HTTP.

In parallel, researchers at SafeDep uncovered two campaigns in npm: 21 packages spoofed the names of CLI binaries from Google's scoped packages, while forks of the Baileys library forced victims' WhatsApp accounts to subscribe to certain channels and slipped advertising links into the images they sent.

Source: The Hacker News