16 Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets
- ID
- 15181
- Status
- summarized
- Published
- 18 Aug 2026, 7:20 PM
- Fetched
- 18 Aug 2026, 9:42 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/16-typosquatted-rubygems-packages-steal.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 4.5
- Created
- 18 Aug 2026, 9:45 PM
- Tags
- Audience
- developers
What happened
Sixteen typosquatted RubyGems packages (e.g., ubnuler, brumdler, activesupmport) were discovered on August 15, 2026, distributing a Windows info-stealer called StubMaker that harvests browser credentials, crypto wallets, seed phrases, and Telegram data. The packages have been yanked, but the campaign exploited a RubyGems design flaw where yanked package names can be reclaimed by new accounts, allowing the same malicious name to be revived after removal.
Why it matters
If you ship Ruby applications, audit your Gemfile.lock against the 16 listed package names and pin dependencies to known-good versions. The broader lesson: RubyGems allows namespace reuse after yanking, so a package name that was safe yesterday is not guaranteed safe today—treat gem names as untrusted identifiers and prefer bundler checksum verification or private gem mirrors for production.
Discussion angle
How RubyGems' namespace-reuse behavior differs from npm/PyPI and whether your team's dependency pinning strategy actually protects against name revival attacks.