16 fake RubyGems packages steal crypto wallets and passwords—typosquatting campaign caught early

Cybersecurity researchers from OpenSourceMalware have uncovered a typosquatting campaign targeting the RubyGems ecosystem with a Windows-based information stealer. The campaign, tracked under the name StubMaker, was first detected on August 15, 2026, and involved 16 malicious packages designed to mimic popular Ruby dependencies.

The full list of typosquatted packages includes: ubnuler, ubnlder, ri18nr, reaker, rakier, orakw, joxn, ise18n, ioe18n, ie18u, iai8n, i1l8n, i18om, activesupmport, brumdler, and brundlef. According to security researcher Paul McCarty (aka 6mile), these are "clumsy typos" compared to more sophisticated SEO-driven typosquatting campaigns seen in the past. The malware is designed to harvest browser credentials, cryptocurrency wallets, seed phrases, and Telegram data.

The packages were published by two accounts: "mod8rz41mje" (identified as Riley Miller) and "rbq95bwt6q" (identified as Alex Davis). As of the time of writing, all 16 packages have been yanked from the RubyGems repository.

In at least two instances—brumdler and brundlef—the threat actors exploited a known behavior in RubyGems: once all versions of a gem are removed, its namespace becomes available for anyone to claim. These two packages were originally published by the account "gemlewqqhu1" (Taylor Moore) before being reclaimed by the aforementioned malicious accounts.

Jenn Gile, co-founder of OpenSourceMalware, noted that while the campaign was disrupted relatively early, it highlights a persistent vulnerability in the RubyGems ecosystem. The attack demonstrates how easily typosquatting can be used to distribute malware, especially when combined with namespace reclamation tactics. The researchers urge developers to double-check package names before installation and to use tools that verify the authenticity of dependencies.