StubMaker: 16 typosquatted RubyGems packages, and an audit list for Windows dev machines

Researchers at OpenSourceMalware said they discovered a typosquatting campaign against RubyGems on August 15, 2026, and are tracking the Windows information stealer it delivers under the name StubMaker ^[1]. Sixteen gems were involved, all of them misspellings of popular Ruby dependencies, which means the blast radius is a finite list you can grep your lockfiles and CI caches for today ^[2].

The names, per OpenSourceMalware: ubnuler, ubnlder, ri18nr, reaker, rakier, orakw, joxn, ise18n, ioe18n, ie18u, iai8n, i1l8n, i18om, activesupmport, brumdler, brundlef ^[2]. Security researcher Paul McCarty said these are not the SEO-tuned squats seen from other crews, such as events-channel imitating the Node.js events module, but "clumsy typos" ^[3]. Clumsy is not the same as ineffective. A fat-fingered gem name only has to survive one code review to reach a build agent.

The execution path is the part worth internalising. According to the researchers, the gems use an "extconf.rb" hook, which RubyGems runs automatically at install time and which normally configures native extensions in a package's "ext/" directory ^[4]. Here it fetches a 22 MB Rust loader from a GitHub release, which launches an embedded Go stealer called "wincfg"; the hosting account, github[.]com/bebraz1, is no longer reachable ^[5]. McCarty said StubMaker builds nothing: it emits a Makefile with empty all, install and clean targets plus Unix and Windows stub scripts that return success, so the extension phase reports a clean build while the beacon and loader fetch happen in the installer hook ^[6]. Anyone watching for compiler noise or build failures sees a green light.

The payload includes a DLL, "abe_payload.dll", used to pull credentials from Chromium-based browsers while circumventing the app-bound encryption protections Google added; the researchers list ten, including Chrome, Edge, Brave, Opera, Opera GX, Vivaldi, Yandex, Avast, AVG and CCleaner Browser ^[7][8]. It also takes extension data, browsing history, payment card numbers, cryptocurrency wallets and seed phrases, Telegram Desktop data and system information, and queries api.ipify[.]org for the public IP ^[9]. Collected data goes to Gofile as a password-protected ZIP, with the download link sent to "dresslee.com" over plain HTTP ^[10].

The registry mechanics are the durable lesson. The gems were published by accounts "mod8rz41mje" (Riley Miller) and "rbq95bwt6q" (Alex Davis), and have since been yanked ^[11]. In at least two cases, brumdler and brundlef, the actor exploited a known RubyGems behaviour that frees a namespace for anyone to claim once all versions of a gem are yanked; both had first been published by "gemlewqqhu1" (Taylor Moore) before the two accounts reclaimed them ^[12]. Jenn Gile, co-founder of OpenSourceMalware, told The Hacker News that the campaign was disrupted early but was made more effective by Ruby's "poor design choices" around name reuse and an unvalidated author field: yanking a gem let the actor create a new owner account and republish under the same name, so "what should have been forever dead was revived to compromise more people" ^[13]. Gile added that the actor set a different Author value per gem to make them look unrelated, because the Author field is unvalidated plaintext that need not match the owner ^[14].

Two things to watch. First, whether RubyGems changes the yank-and-reclaim behaviour, because until it does, takedown is not remediation and your allowlists cannot treat a name as permanently safe. Second, the npm side: the same disclosure window included a cluster of 21 npm packages typosquatting CLI binary names exposed by Google's scoped packages ^[15]. Install-time hooks remain the common denominator across both registries ^[4][15].