StubMaker Campaign Exploits RubyGems Flaw to Deploy Windows Infostealer

Cybersecurity researchers at OpenSourceMalware have uncovered a sophisticated supply chain campaign on RubyGems dubbed "StubMaker." The operation deployed 16 malicious packages designed to infiltrate Windows environments and exfiltrate sensitive user data.

The campaign, attributed to accounts 'mod8rz41mje' and 'rbq95bwt6q', utilized a multi-stage attack chain to compromise targets. The process begins with an 'extconf.rb' hook that downloads a 22 MB Rust-based loader from GitHub. This loader subsequently deploys a Go-based infostealer known as 'wincfg.' Once active, the malware harvests browser credentials, cryptocurrency wallets, seed phrases, and Telegram data.

The Namespace Reuse Flaw

While typosquatting—publishing packages with names similar to popular libraries—is a common tactic, StubMaker employed a more persistent method. The threat actors exploited a critical flaw in the RubyGems ecosystem that allows for namespace reuse. This vulnerability enabled the attackers to republish malicious versions of packages, such as 'brumdler' and 'brundlef', even after they had been yanked from the registry.

Jenn Gile, co-founder of OpenSourceMalware, highlighted the danger of this mechanism, stating, "What should have been forever dead was revived to compromise more people." By reviving removed packages, the attackers bypassed standard cleanup efforts and maintained a persistent threat vector against developers who might attempt to install the libraries.

Technical Exfiltration

Beyond the initial infection, the StubMaker malware employs techniques to bypass modern security measures. The infostealer is capable of circumventing app-bound encryption (ABE) in Chromium-based browsers, a security feature designed to prevent credentials from being stolen by unauthorized applications. After harvesting the data, the malware packages the stolen information into password-protected ZIP archives and uploads them to the file-sharing service Gofile.

Industry Implications

This campaign underscores a systemic vulnerability in how RubyGems handles package names and author validation. The ability for malicious actors to reclaim and reuse namespaces creates a significant gap in the trust model of the Ruby ecosystem. For the broader industry, it demonstrates that simply removing a malicious package is no longer a sufficient remediation step if the underlying registry allows for the reuse of that package's identity.

What's Next

Developers are advised to double-check package names and verify authors before installation. The security community is now watching to see if RubyGems will implement stricter policies regarding namespace reuse to prevent similar "revival" attacks. While the 16 identified packages have been addressed, the discovery of the namespace flaw suggests that other dormant or yanked packages could potentially be weaponized using the same method.