Security News
A researcher has uncovered malicious packages in the RubyGems repository, one of which was downloaded more than 2,000 times. The research found over 400 suspect gems including "Atlas-client", which was downloaded 2,100 times by developers likely looking for the legitimate gem named atlas client.
Researchers have discovered over 760 malicious Ruby packages typosquatting on RubyGems, the Ruby community's gem repository / hosting service. ReversingLabs analysts wanted to see how widespread the practice of package typosquatting is within RubyGems.
As developers increasingly embrace off-the-shelf software components into their apps and services, threat actors are abusing open-source repositories such as RubyGems to distribute malicious packages, intended to compromise their computers or backdoor software projects they work on. In the latest research shared with The Hacker News, cybersecurity experts at ReversingLabs revealed over 700 malicious gems - packages written in Ruby programming language - that supply chain attackers were caught recently distributing through the RubyGems repository.
An update released last week for RubyGems includes several security improvements and patches for various types of vulnerabilities. read more
RubyGems patched an unsafe object deserialization vulnerability this week that could have allowed attackers to remotely execute code on vulnerable systems.
RubyGems maintainers patched a vulnerability, reported by Trustwave and OpenDNS, that allows RubyGem clients to be redirected to an attacker-controlled gem server.
A serious vulnerability in RubyGems, a package manager for the Ruby programming language, can be exploited to trick end users into installing malware from attacker-controlled gem servers, Trustwave re...
