Poisoned Pipeline / Incidents / AS178

AS178 · 2025-10

60 malicious RubyGems targeted credential theft

RubyGems

Socket: 60 malicious Ruby gems used in a targeted credential-theft campaign.

Mapped techniques

• T0109 Publish malicious artifact
• T0184 Harvesting sensitive information from files

supply-chain campaign

Sources

• https://socket.dev/blog/60-malicious-ruby-gems-used-in-targeted-credential-theft-campaign