Poisoned Pipeline / Incidents / AS44
StubMaker RubyGems (and npm) Windows infostealer
RubyGemsnpmGit / GitHubLinux distro / packagesmacOS softwareWindows software
On 15 August 2026 OpenSourceMalware found newly published RubyGems
typosquats whose extconf.rb fakes a native-extension build (empty make
targets / make_stub) while downloading a 22 MB Rust loader from GitHub
Releases. The loader carries an 11 MB Go infostealer in its own data
section — no second-stage URL after the first fetch. Targets browser
passwords (including Chromium ABE), wallets, seed phrases, Telegram.
A parallel npm cluster shared IOCs (StubMaker). Hundreds of downloads
before takedown.
Mapped techniques
- T0129 Typosquatting
- T0109 Publish malicious artifact
- T0151 Installation scripts
- T0198 Malicious Build Time Dependencies
- T0184 Harvesting sensitive information from files
supply-chain RubyGems typosquats
Clumsy typos of popular Ruby gems.
Malicious gems (and later npm twins) published to the registry.
extconf.rb runs at gem install and fetches the loader.
Fake native-extension build (StubMaker) so install looks like a routine compile.
Browser creds, wallets, Telegram data stolen on Windows.