16 Typosquatted RubyGems Packages Deploy Information Stealer Targeting Credentials and Crypto Wallets

Researchers from OpenSourceMalware have flagged a new typosquatting campaign targeting RubyGems users. The threat is being tracked under the moniker StubMaker. The campaign involves the distribution of malicious packages whose names are intentionally similar to legitimate RubyGems projects, relying on typographical errors by users during installation.

The complete list of packages identified as part of the campaign includes: ubnuler, ubnlder, ri18nr, reaker, rakier, orakw, and joxn. OpenSourceMalware discovered the activity on August 15, 2026, and reported the findings publicly on August 18, 2026.

According to the research, the malicious packages contain a Windows-based information stealer. Upon installation, the stealer is designed to target browser-stored credentials and cryptocurrency wallet files. The goal of the campaign appears to be the theft of sensitive data that could lead to account takeover and financial loss for affected users.

The reliance on typosquatting techniques means that users searching for popular or legitimate RubyGems packages may inadvertently install these malicious alternatives if they mistype the package name. The research highlights the ongoing risk posed by package repository typosquatting and the importance of verifying package authenticity before installation.

RubyGems maintainers and the broader security community are urged to improve package verification processes. Users are advised to exercise caution when installing packages and to double-check package names against official sources.