Malicious RubyGems Packages Impersonate Popular Libraries to Steal Windows Credentials
Researchers flagged seven typosquatted gems on August 15, 2026, part of a wider campaign delivering a Windows information stealer.
Key points
- OpenSourceMalware disclosed a typosquatting campaign against RubyGems users on August 15, 2026.
- The researchers named the activity StubMaker and linked it to a Windows information stealer.
- Seven look-alike package names have been published so far: ubnuler, ubnlder, ri18nr, reaker, rakier, orakw and joxn.
- The malicious gems mimic common Ruby library names, betting on developers mistyping a package.
- Developers who installed any of the listed packages on Windows should treat that machine as compromised.
A fresh wave of fake software packages is targeting Ruby developers, and the goal is theft.
On August 15, 2026, the research group OpenSourceMalware said it had found a typosquatting campaign on RubyGems, the main place Ruby programmers download open-source code libraries. Typosquatting is a simple trick: attackers publish packages with names that look almost identical to popular ones, hoping a developer mistypes a letter and installs the malicious version instead.
The researchers are tracking the campaign as StubMaker. It delivers an information stealer, meaning malicious software designed to hoover up saved passwords, browser data and other secrets from a victim's computer. In this case the payload targets Windows machines.
The activity was first reported by The Hacker News.
Which packages are involved?
So far, seven gem names have been named publicly. Each one is a near-miss of a legitimate Ruby library.
| Malicious gem | Likely target |
|---|---|
| ubnuler | common utility name |
| ubnlder | common utility name |
| ri18nr | i18n (internationalisation) |
| reaker | rake (Ruby build tool) |
| rakier | rake |
| orakw | rake |
| joxn | json |
The pattern is consistent. Drop a letter, swap a letter, add a letter. A tired developer running gem install at the end of the day is exactly who this preys on.
What does the malware actually do?
It steals data from Windows computers. OpenSourceMalware classes StubMaker as an information stealer, a category of malware that typically grabs saved browser passwords, session cookies, cryptocurrency wallet files and anything else a criminal can resell or reuse.
The wider technical breakdown, including how the stealer is packed and what it exfiltrates, sits with the OpenSourceMalware writeup. The campaign name refers to the stub, or small loader program, the attackers use to launch the stealer once a developer runs the poisoned gem.
Ruby code often runs with the same permissions as the developer who installed it. If that developer has access to production keys, cloud tokens or a company password manager, the stealer can grab those too.
Should developers be worried?
Yes, if they work on Windows and install gems by hand. The risk is narrow but real: one mistyped command can hand over an entire workstation's secrets.
Anyone who installed one of the seven names above should assume the machine is dirty. Rotate any passwords stored in the browser. Revoke API tokens and cloud credentials that touched the box. Rebuild the machine rather than trying to clean it.
Teams should also check their build servers. Continuous integration systems, the automated machines that compile and test code, often install gems from a lockfile. A single bad entry there spreads the infection to every build.
Common questions
How do I tell if a RubyGems package is legitimate?
Check the exact spelling against the project's official site or GitHub repository before installing. Look at download counts, publication date and maintainer history: a package one week old with a name close to a famous library is a red flag.
Does this affect Mac or Linux developers?
The stealer payload described by OpenSourceMalware targets Windows. Installing the malicious gem on macOS or Linux is still not safe, because the package itself is hostile, but the specific credential theft described here runs on Windows.
