🧰 RubyGems.org

The items that name it 4

• StubMaker RubyGems Campaign Delivers a Windows Infostealer
  writeupas affected products2026-08-16

  Ecosystem abused; namespace-reclaim behavior after gem yanking allows any account to claim a freed gem name with no reservation period (rubygems/rubygems.org#1226, discussion #2787)

• [tl;dr sec] #341 - Hugging Face Incident Black Hat Talk, CSS Bomb in your Inbox, GitHub Supply Chain Security Improvements
  articleas affected products2026-08-13It is written here as RubyGems.org (CDN cache vulnerability exposing legacy API keys via GET /api/v1/api_key; RubyGems CLI 3.2.0 and later had already moved off the vulnerable endpoint).

  CDN cache vulnerability exposing legacy API keys via GET /api/v1/api_key; RubyGems CLI 3.2.0 and later had already moved off the vulnerable endpoint

• SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor
  writeupas tools2026-07-19

  Public gem registry where the malicious package versions were published directly, with no matching commit or tag in the source projects.

• Socket: RubyGems Bundler 4.0.13 Adds Opt-In Cooldown for Newly Published Gems
  articleas tools2026-06-13

  Ruby package registry; provides per-version created_at metadata via v2 compact index that Bundler uses for cooldown, and hosts other security features (push-time validation, HIBP checks, 2FA, trusted publishing, AI-assisted vulnerability scanning)