Supply Chain — StubMaker Typosquatting Campaign in RubyGems and npm Compromises Credentials and Crypto Wallets (N/A)

Publication date: August 18, 2026
Category: Cybersecurity / Supply Chain / Malware

Introduction

Cybersecurity researchers at OpenSourceMalware and SafeDep have uncovered a coordinated and sophisticated supply chain typosquatting campaign targeting both the RubyGems and npm package registries. Tracked under the moniker StubMaker, the activity initially involved 16 malicious RubyGems packages before expanding into a cohort of over 37 npm packages, alongside a variant named BRIDGEHEAD analyzed by CloudSEK. The campaign exploits automated dependency installation hooks to fetch, deploy, and execute a Rust-based loader and a Go infostealer on developer workstations running Windows.

What is StubMaker? (General Analysis)

StubMaker represents an abuse of software supply chain mechanisms rather than a traditional vulnerability in package manager code. Threat actors published packages with names deceptively similar to popular dependencies (e.g., activesupmport, brumdler, axios-http, lodash-lib), relying on developer typos or automated build pipeline inclusions. Furthermore, attackers took advantage of namespace reuse policies in RubyGems, reclaiming previously yanked package names to revive malicious versions under new, unverified author identities.

With no official CVE identifier assigned (CVE: N/A), this incident is mapped conceptually to CWE-506: Embedded Malicious Code and CWE-1357: Reliance on Unverified Inputs in Software Supply Chain. Because the attack exploits native design features of the package managers rather than a software bug, the risk is rated as Critical (Estimated CVSS v3.1: 9.8 / [AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/H:H]), given its capability to silently compromise the entire host system of an affected developer.

How Does It Work? (Technical Analysis)

The infection vector varies slightly across ecosystems while maintaining a modular execution chain:

  • Phase 1: Initial Vector and Execution Trigger:
    • In RubyGems, the payload utilizes the extconf.rb hook, which runs automatically during gem installation when native extensions are compiled. The authors created empty Makefiles to simulate a clean build while executing malicious beaconing in the installation script.
    • In npm, the campaign leverages post-install lifecycle scripts to execute payloads upon package installation.
  • Phase 2: Loader Fetching:
    • The installation script decodes a payload URL (via Base64 in Ruby and repeated-key XOR in npm) to download a 22 MB Rust-based loader hosted on external GitHub releases (github[.]com/bebraz1).
  • Phase 3: Infostealer Deployment and ABE Bypass:
    • The Rust loader drops a Go-based binary (wincfg) containing a malicious DLL (abe_payload.dll). This component extracts credentials from Chromium-based browsers by bypassing Google’s App-Bound Encryption (ABE) protections.
    • In the BRIDGEHEAD variants documented by CloudSEK, a Windows Subsystem for Linux (WSL) gate is implemented, allowing packages installed inside Linux environments on Windows to act as a bridge targeting the underlying Windows OS.
  • Phase 4: Exfiltration:
    • Gathered data—including browsing history, payment cards, crypto wallets, seed phrases, and Telegram data—is compressed into a password-protected ZIP archive and uploaded to public file hosting (Gofile), with download links transmitted to an unencrypted C2 HTTP endpoint.

Affected Systems / Environments

The primary targets are developers and environments operating on Microsoft Windows (including WSL environments).

  • RubyGems Ecosystem: 16 identified packages, including ubnuler, ubnlder, ri18nr, reaker, rakier, orakw, joxn, ise18n, ioe18n, ie18u, iai8n, i1l8n, i18om, activesupmport, brumdler, and brundlef.
  • npm Ecosystem: Over 40 packages impersonating major libraries such as axios, chalk, commander, lodash, typescript, and react.

Mitigation and Detection

Remediation

  • Host Isolation: Immediately isolate any Windows development workstation where affected packages were installed.
  • Credential Rotation: Revoke and rotate all web credentials, API keys, GitHub tokens, and cryptocurrency wallet seed phrases managed on compromised hosts.
  • Dependency Audit: Review Gemfile.lock and package-lock.json files to ensure no malicious typosquatted libraries are present.

Detection

Defensive teams should monitor for unauthorized network connections originating from package manager processes (ruby.exe, node.exe) towards external code hosting or file-sharing services.

yaml 
# Sigma rule concept for detecting malicious installer network activity
title: External Download via Package Manager Install Hooks
status: experimental
level: critical
description: Detects package installation hooks initiating outbound connections to download external binaries.
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: 
      - '\node.exe'
      - '\ruby.exe'
    CommandLine|contains:
      - 'github.com'
      - 'gofile.io'
      - 'extconf.rb'
  condition: selection
falsepositives:
  - Minimal false positives if development policies restrict unverified network activity during package installation.

Threat Intelligence Note: The ability to reclaim yanked package names in public registries creates an ongoing supply chain risk where removing a malicious package does not prevent threat actors from resurrecting the exact namespace under new burner accounts.

Wrapping Up

The StubMaker campaign underscores the persistent and pervasive threat of software supply chain attacks targeting developer ecosystems. By abusing automated installation hooks and combining multi-stage Rust loaders with advanced Windows infostealers, threat actors can bypass traditional perimeter controls and extract high-value credentials within moments of installation. Rigorous dependency pinning, registry monitoring, and strict control over install scripts remain vital defenses.

References