Security News > 2020 > April > Over 700 Malicious Typosquatted Libraries Found On RubyGems Repository

As developers increasingly embrace off-the-shelf software components into their apps and services, threat actors are abusing open-source repositories such as RubyGems to distribute malicious packages, intended to compromise their computers or backdoor software projects they work on.

In the latest research shared with The Hacker News, cybersecurity experts at ReversingLabs revealed over 700 malicious gems - packages written in Ruby programming language - that supply chain attackers were caught recently distributing through the RubyGems repository.

The malicious campaign leveraged the typosquatting technique where attackers uploaded intentionally misspelled legitimate packages in hopes that unwitting developers will mistype the name and unintentionally install the malicious library instead. ReversingLabs said the typosquatted packages in question were uploaded to RubyGems between February 16 and February 25, and that most of them have been designed to secretly steal funds by redirecting cryptocurrency transactions to a wallet address under the attacker's control.

RubyGems is a popular package manager that makes it easy for developers to distribute, manage, and install Ruby programs and libraries.

It's highly recommended that developers who unintentionally downloaded the libraries into their projects should check to see if they've used the correct package names and did not accidentally use the typosquatted versions.

News URL

http://feedproxy.google.com/~r/TheHackersNews/~3/fBQujiDykNI/rubygem-typosquatting-malware.html