Clumsy Typosquats on RubyGems Hid a Stealer for Browser Logins and Wallets
Researchers at OpenSourceMalware tracked 16 typosquatted RubyGems packages (dubbed StubMaker) that abuse the extconf.rb install hook to drop a Rust/Go Windows info stealer targeting browser credentials, crypto wallets, seed phrases, and Telegram data. Two gems also exposed how yanked namespaces can be reclaimed by attackers. All packages have since been pulled.