Typosquatting attacks on software repositories remain a persistent threat to developers. A new campaign has exploited this vulnerability by publishing 16 malicious packages to RubyGems, the official package manager for the Ruby programming language.
Security researchers at OpenSourceMalware discovered the StubMaker campaign on August 15, 2026. The threat actors registered packages with names deliberately misspelled to resemble legitimate Ruby libraries. Developers searching for common dependencies like "bundler," "rake," and "rails" risk installing these counterfeit packages by mistyping package names during installation.
The malicious packages deliver a Windows-based information stealer capable of harvesting sensitive data from compromised systems. Once executed, the stealer targets browser credentials stored in major browsers including Chrome, Firefox, Edge, and Safari. The malware also hunts for cryptocurrency wallet files and private keys, making this campaign particularly attractive to attackers seeking high-value theft targets.
The confirmed malicious package names include ubnuler, ubnlder, ri18nr, reaker, rakier, orakw, and joxn. Each mirrors the spelling of legitimate Ruby packages, exploiting a common developer mistake. Typosquatting remains effective because package managers like RubyGems prioritize package name matching based on user input. A single keystroke error during dependency installation can result in pulling the malicious version instead of the intended package.
This attack pattern reflects broader trends in supply chain compromises targeting open-source ecosystems. Similar campaigns have struck npm, PyPI, and other repositories. Attackers recognize that developers often focus on functionality rather than verifying package authenticity, particularly under time pressure during development cycles.
The StubMaker information stealer represents a dual-threat scenario. Browser credential theft enables lateral movement across corporate networks and personal accounts, while cryptocurrency wallet theft targets developers who frequently hold digital assets. This combination maximizes the campaign's profit potential.
RubyGems maintainers removed the identified malicious packages following the discovery. However, the repository does not enforce pre-publication security scanning, leaving the burden of threat detection on community researchers and security firms. Developers who may have installed these packages during the active window face immediate risk of credential and wallet compromise.
Mitigation steps for affected users include immediate browser credential changes, cryptocurrency wallet security audits, and system scans with updated malware detection tools. Organizations using Ruby development environments should audit dependency lists for these package names and verify dependency integrity through lock files.
The campaign underscores the ongoing challenge of protecting open-source supply chains. While typosquatting represents a relatively simple attack vector compared to compromising legitimate packages, it remains effective because human error drives installation decisions. Repository operators, package maintainers, and developers must maintain layered vigilance. Automated name-similarity checks during package registration, community reporting mechanisms, and developer education around package verification represent practical defenses against these recurring threats.