42
30
30
16 Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets
Typosquatted RubyGems packages deliver the StubMaker infostealer, stealing browser credentials, crypto wallets, and Telegram data from Windows developers.
OpenSourceMalware discovered a typosquatting campaign on August 15, 2026, tracked as StubMaker, publishing 16 malicious RubyGems packages (e.g., ubnuler, brumdler, brundlef) that imitate popular Ruby dependencies. The gems use the extconf.rb install hook to fetch a 22 MB Rust-based loader from GitHub, which launches a Go-based stealer ("wincfg") containing a DLL that bypasses Chromium's app-bound encryption to extract browser credentials, payment cards, crypto wallets and seed phrases, and Telegram Desktop data. Stolen data is uploaded as a password-protected ZIP to Gofile, with the download link sent over plain HTTP. The same actor also deployed 37 typosquatted npm packages delivering the identical loader and infostealer, and abused RubyGems' namespace reuse to republish malicious versions of yanked gems.
55
60
45
42
42
42
30
30
30
57
42
57
42
42
42
60
42
45
42
55
30
42
30
42
57
60
30
60
60
42
42
Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads
Compromised maintainer account published malicious versions of popular Rust crates with 245M downloads, delivering a build-time payload via typosquatted proc-macro1 dependency.
The Rust Project deleted malicious releases of arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9 from crates.io after a compromised maintainer account added a typosquatted dependency, proc-macro1, whose build script downloaded and executed a remote payload during compilation. Each malicious version was online for 86 to 107 minutes on August 20, 2026, before deletion. The build script disabled TLS validation and deployed OS-specific implants on Unix, macOS, and Windows, with builds alone sufficient to trigger execution. Wiz Research confirmed active exploitation, noting the impacted packages appear in 35% of cloud and code environments and over 75% of Rust-using environments; arrayref alone has 245 million all-time downloads and 403 dependent crates.
82
45
42
60
57
42