Security researchers have identified 16 malicious RubyGems packages that use typosquatting to deliver a Windows information stealer. The packages target developers by mimicking popular Ruby dependencies and harvest browser credentials, cryptocurrency wallets and other sensitive data.
The campaign was discovered in mid-August 2026.
The Drivers of This Activity
OpenSourceMalware detected the activity on 15 August and is tracking the threat under the name StubMaker. The 16 packages carry names that are deliberate but relatively clumsy misspellings of widely used Ruby libraries.
Once installed, the malicious gems abuse the extconf.rb install hook to deploy a Windows-based stealer. According to researcher Paul McCarty, the malware collects browser credentials, cryptocurrency wallets, seed phrases and Telegram data. Unlike more sophisticated SEO-style typosquatting seen in other ecosystems, these packages rely on simple typing errors that developers might make when adding dependencies.
The packages have since been flagged, and the full list of malicious gem names has been published by the researchers.
Impact and Broader Context
Supply-chain attacks via package registries remain a persistent risk for developers. Even basic typosquatting can succeed when users install dependencies without carefully verifying package names or sources. The inclusion of crypto-wallet and seed-phrase targeting makes the campaign especially relevant to users who handle digital assets on the same machines used for development.
Developers are advised to audit recently installed gems, verify package names against official sources, and use dependency scanning tools. Package maintainers and registry operators continue to face pressure to improve detection of typosquatted and malicious uploads.
Further analysis of the stealer’s capabilities and any related infrastructure will help determine the full scope of the campaign.
Source: The Hacker News
StubMaker campaign