Security researchers at OpenSourceMalware discovered 16 malicious packages published to RubyGems, the package registry used by Ruby developers. The packages, tracked as the “StubMaker” campaign, are clumsy typosquats of popular gems — names like activesupmport instead of activesupport, brumdler instead of bundler, and short misspellings like ubnlder and reaker. They were published under two accounts, “mod8rz41mje” and “rbq95bwt6q,” and have since been yanked from the registry.
The attack works by abusing a standard Ruby installation hook (extconf.rb) that runs automatically when a gem is installed. In this case the hook silently downloads a 22 MB Rust-based loader from a (now-removed) GitHub account, which in turn launches a Go-based stealer called “wincfg.” The stealer includes a DLL that bypasses Google’s App-Bound Encryption (ABE) protection to extract saved passwords and payment card numbers from Chromium-based browsers — Chrome, Edge, Brave, Opera, Vivaldi, and others. It also collects browser extension data and browsing history, searches for cryptocurrency wallet files and seed phrases, extracts Telegram Desktop data, and beacons the victim’s public IP to an external service. A compounding issue: the threat actor exploited a RubyGems design flaw where yanked package names can be reclaimed, allowing the same malicious gem to be re-published under a new account after the first was removed.
How to check if you’re affected
Affected products include any Ruby project that installed one of the 16 packages in this campaign before they were yanked: ubnlder, ri18nr, reaker, rakier, orakw, joxn, ise18n, ioe18n, ie18u, iai8n, i1l8n, i18om, activesupmport, brumdler, or brundlef. Run gem list in your project environment and look for any of these names. If found, remove the gem immediately, rotate any stored browser credentials and cryptocurrency wallet seeds on that machine, and treat the system as potentially compromised.