Poisoned Pipeline / Incidents / AS265
strong_password Ruby gem backdoor stole secrets
Catalogued from the tstromberg supplychain-attack-data dataset
(community-curated incident corpus). Included because first-party
sources exist for it; see the links below — vendor advisories, project
incident reports, and researcher write-ups. Not based on aggregator
coverage.
Mapped techniques
- T0172 Runtime backdoor
- T0184 Harvesting sensitive information from files
- T0121 Compromised legitimate artifact
- T0109 Publish malicious artifact
supply-chain campaign
Backdoor/RAT payload documented by the cited sources.
Credential or wallet material targeted.
Published package versions carried the payload.
Named in the tstromberg supplychain-attack-data corpus with first-party references.
Sources
- https://www.sonatype.com/blog/cve-2019-13354-strong-password
- https://withatwist.dev/strong-password-rubygem-hijacked.html
- https://news.ycombinator.com/item?id=20382779
- https://snyk.io/blog/code-execution-back-door-found-in-rubys-rest-client-library/
- https://www.helpnetsecurity.com/2019/08/21/backdoored-ruby-gems/