16 Fake RubyGems Steal Browser Creds, Crypto Wallets

Sixteen malicious packages on RubyGems.org are distributing StubMaker, a Windows-based information stealer that targets browser credential stores and cryptocurrency wallets. OpenSourceMalware identified the campaign on August 15, 2026; The Hacker News published details on August 18.

The packages use typosquatting — names designed to resemble legitimate, commonly-used Ruby gems — to slip past developers who mistype a package name or copy a dependency without verifying it.

What StubMaker exfiltrates

Once installed on a Windows machine, StubMaker collects:

• Browser credentials: saved passwords, session cookies, and autofill data from Chromium-based browsers and Firefox
• Crypto wallet data: locally stored wallet files and seed phrase material

Current analysis indicates this is Windows-only. macOS and Linux Ruby environments are not affected by this particular payload.

Packages identified so far

OpenSourceMalware’s report covers 16 packages. Seven confirmed names from initial disclosures:

• ubnuler
• ubnlder
• ri18nr
• reaker
• rakier
• orakw
• joxn

The full list of all 16 is in the complete report via The Hacker News. Check that list before deciding you’re clear.

What to do

If you find any of these packages in your dependency tree, treat the machine as compromised and rotate first, investigate second.

1. Audit Gemfile.lock now — search for the package names above. bundle exec gem list will show everything installed in the current bundle; cross-reference against the full 16-package list in the linked report.

2. Rotate browser credentials — any saved passwords, tokens, or cookies on an affected Windows machine should be considered exfiltrated. Prioritize high-value accounts: email, VPN, cloud consoles, code repositories, and anything with 2FA seed access.

3. Check crypto accounts — if the machine had wallet software or a browser extension managing crypto, check transaction history for unauthorized activity and move funds to a wallet generated on a clean device.

4. Verify Gemfile source declarations — your Gemfile should specify source "https://rubygems.org". Confirm gems are not being pulled from a mirror or private registry that could serve tampered versions.

5. Add bundler-audit to your pipeline — bundler-audit won’t catch a novel campaign like this on day one, but it catches known-bad gems and narrows your attack surface between advisory cycles.

6. Lock and pin versions explicitly — transitive dependency drift is how packages like this get introduced without anyone noticing a new gem appeared.

Priority

This is a today problem if you have Windows-based Ruby dev environments or CI workers running bundle install against the public registry without version pinning. The packages appear to have been live since at least August 15.

RubyGems has been an active targeting surface this summer. In July, SleeperGem loaders were found hiding inside dormant Ruby packages, using maintainer accounts dormant since 2018–2020 to push malicious updates. Two distinct campaigns in under a month is a signal: if you’re responsible for Ruby environments, set up dependency monitoring so you’re not auditing reactively after the next one surfaces.