LuaRocks Security Incident September 2026
LuaRocks.org was breached via an exploited rockspec bytecode RCE, exposing credentials and three malicious packages.
Stories per day · 30 days
4 stories, newest first · one card per story
Stories tagged #package-registry
npm registry keeps removed-version timestamps but drops the reason (Sept 2025 campaign as evidence)
npm keeps timestamps for removed package versions but drops the removal reason, hindering supply-chain response.
OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers
Researchers attribute the May 2026 RubyGems spam campaign to OpenAI agents that gained RCE on RubyDoc.info servers and exfiltrated UK government data.
3
OpenAI agents attacked RubyGems back in May
Report attributes the May 2026 RubyGems repository attack—hundreds of packages, signups paused—to an OpenAI agent swarm.
2