Typosquatted RubyGems Packages Deliver StubMaker Infostealer
A campaign distributing 16 typosquatted RubyGems packages has been uncovered, delivering a Windows information stealer named StubMaker that targets browser credentials and cryptocurrency wallets.
Cybersecurity researchers have identified a new typosquatting campaign actively distributing malicious packages on the RubyGems repository. The campaign, discovered on August 15, 2026, involves 16 packages that are subtly misspelled versions of legitimate Ruby dependencies. These malicious gems are designed to trick developers into installing them, thereby deploying a Windows-based information stealer dubbed StubMaker.
The StubMaker malware is capable of harvesting a wide range of sensitive data, including browser credentials, cryptocurrency wallet information, seed phrases, and Telegram chat data. Security researcher Paul McCarty noted that the typosquatting attempts were "clumsy," differing from more sophisticated methods seen previously, yet still effective due to the nature of package repositories.
The malicious packages were published under developer accounts "mod8rz41mje" (Riley Miller) and "rbq95bwt6q" (Alex Davis). While the packages have since been removed from RubyGems, the campaign highlighted a concerning vulnerability in the repository's design. In some instances, threat actors exploited RubyGems' behavior where a package namespace becomes available for reuse once all its versions are yanked.
This reuse allowed the attackers to re-register package names like "brumdler" and "brundlef" after their original legitimate versions were removed. Jenn Gile, co-founder of OpenSourceMalware, pointed out that RubyGems' "poor design choices," such as package name reuse and an unvalidated author field, facilitated the campaign's effectiveness. The ability to re-publish under the same name after a package was yanked allowed the malicious activity to continue impacting users.
The attack chain leverages the "extconf.rb" hook, which executes automatically during gem installation, similar to npm's lifecycle hooks. This script is typically used for compiling native extensions. In the StubMaker attack, the hook downloads a Rust-based loader from a GitHub release (now inaccessible), which then executes a Go-based stealer payload named "wincfg."
The stealer incorporates a DLL payload designed to extract credentials from Chromium-based web browsers by bypassing their built-in security protections. It also targets extension data, browsing history, payment card numbers, cryptocurrency wallets, Telegram data, and system information. The collected data is then packaged into a password-protected ZIP archive and uploaded to Gofile, with the download link sent to the attacker via an unencrypted HTTP channel.
McCarty explained that the malware's name, StubMaker, refers to its technique of generating a Makefile with empty targets and stub scripts. This creates a facade of a legitimate build process, masking the actual malicious activity that occurs within the installer hook itself.
The discovery of StubMaker on RubyGems coincides with reports of similar malicious activity on the npm registry, including campaigns involving typosquatted CLI binary names and malicious forks of the Baileys package. These incidents underscore the persistent threat of supply chain attacks across various software package repositories.