Cybersecurity researchers have uncovered a typosquatting campaign that used 16 malicious RubyGems packages to deploy a Windows-based information stealer targeting browser credentials, cryptocurrency wallets, and Telegram data. OpenSourceMalware identified the activity on August 15, 2026, and is calling the threat StubMaker. The attack exploited a design flaw in RubyGems that allows anyone to reclaim a package name once all versions have been removed, letting the attacker republish malicious code under trusted names even after detection.

The 16 malicious gems—including typosquats like "ubnuler," "ri18nr," "rakier," "joxn," "i18om," and "activesupmport"—were published by two user accounts named "mod8rz41mje" (Riley Miller) and "rbq95bwt6q" (Alex Davis). All packages have since been yanked from RubyGems. In at least two cases, "brumdler" and "brundlef," the attacker reclaimed package names originally published by another account after they'd been removed. The malware uses an "extconf.rb" hook—a file that runs automatically during gem installation—to download a 22 MB Rust-based loader from a now-inaccessible GitHub account, which then launches a Go-based stealer called "wincfg." The stealer harvests credentials from ten Chromium-based browsers including Chrome, Edge, Brave, and Opera by bypassing Google's app-bound encryption, and also collects browser extensions, payment card numbers, cryptocurrency seed phrases, Telegram Desktop data, and system information before uploading everything to Gofile as a password-protected archive.

According to Jenn Gile, co-founder of OpenSourceMalware, the campaign became more effective because of "poor design choices" in RubyGems around package name reuse and an unvalidated author field. "When one of the malicious gems was yanked, the threat actor was able to spin up a new owner account and publish a new malicious version under the same package name," Gile explained. "What should have been forever dead was revived to compromise more people." Security researcher Paul McCarty noted that "StubMaker doesn't build anything—it generates a Makefile with empty all, install, and clean targets," plus stub scripts that report a successful build while the actual malicious work happens in the installer hook itself. The disclosure also coincides with two separate npm supply chain campaigns: 21 packages that typosquatted CLI binary names from Google's scoped packages, and 70 Baileys npm forks that covertly make installers' WhatsApp accounts follow channels controlled by the package author.

The attack works because RubyGems' "extconf.rb" file runs automatically when a user installs a gem, similar to npm's lifecycle hooks. This file is normally used to configure native extensions written in C, C++, or Rust that compile during installation, but StubMaker abuses it to fetch the malicious loader while creating a fake build toolchain that makes the install appear routine. The DLL payload embedded in the stealer specifically targets app-bound encryption protections added by Google to Chromium browsers, allowing it to extract credentials that would otherwise be protected. Once data is captured, the stealer sends the Gofile download link to the attacker's server at "dresslee.com" over an unencrypted HTTP channel. An update to the campaign reveals the same threat actor also deployed 37 typosquatted npm packages—including variants of axios, chalk, commander, lodash, typescript, and react—using a postinstall hook to retrieve the identical Windows loader and Go infostealer, with all packages published on August 16, 2026, in an eight-minute window across five accounts.

OpenSourceMalware recommends that anyone who installed one of these packages on a Windows machine during the active period should immediately isolate the host, rotate all credentials, and remove the malicious libraries. The researchers noted key differences between the two campaigns: the RubyGems attack used Base64 encoding for the loader URL while npm used XOR encryption with a hard-coded key, and the gems were published sequentially over two days from fewer accounts while the npm packages were uploaded simultaneously across multiple burner accounts to avoid a single point of failure. Gile observed that "RubyGems' pattern was sequential and single-point-of-failure," meaning one caught account prompted the operator to adapt and return, whereas "npm's pattern spread the same burst across multiple burner accounts simultaneously, so losing any one account wouldn't have taken down the whole batch." The campaign highlights how ecosystem-level design decisions around namespace management and author validation can amplify the damage from what would otherwise be clumsy typosquatting attempts. Package managers that allow indefinite name recycling after removal create persistent attack surfaces, while unverified author fields let single operators masquerade as multiple publishers to evade pattern detection and prolong campaigns.