StubMaker: 16 typosquatted RubyGems packages, and an audit list for Windows dev machines
OpenSourceMalware flagged the campaign on August 15, 2026. The install hook fakes a clean native build while pulling a Windows stealer that goes after browser credentials and crypto wallets.
The Watch · Security desk
What happened
- OpenSourceMalware discovered a typosquatting campaign targeting RubyGems users with a Windows-based information stealer on August 15, 2026, and tracks the threat under the moniker StubMaker.
- The campaign comprised 16 packages: ubnuler, ubnlder, ri18nr, reaker, rakier, orakw, joxn, ise18n, ioe18n, ie18u, iai8n, i1l8n, i18om, activesupmport, brumdler, brundlef. All appear to be typosquats of popular Ruby dependencies.
- Security researcher Paul McCarty said the packages are not the clever SEO-fueled typosquats seen from other threat actors, such as events-channel imitating the popular Node.js events module, but are "all clumsy typos".
- The attack chain uses an "extconf.rb" hook, which is run automatically when a user installs a gem, similar to npm lifecycle hooks; the file is typically used to configure native extensions written in C, C++ or Rust bundled in a package's "ext/" directory and compiled during installation.
- The Ruby hook fetches a 22 MB Rust-based loader from a GitHub release, which launches an embedded Go-based stealer payload named "wincfg". The GitHub account github[.]com/bebraz1 is no longer accessible.
Why it matters
Researchers at OpenSourceMalware said they discovered a typosquatting campaign against RubyGems on August 15, 2026, and are tracking the Windows information stealer it delivers under the name StubMaker [1]. Sixteen gems were involved, all of them misspellings of popular Ruby dependencies, which means the blast radius is a finite list you can grep your lockfiles and CI caches for today [2].
The names, per OpenSourceMalware: ubnuler, ubnlder, ri18nr, reaker, rakier, orakw, joxn, ise18n, ioe18n, ie18u, iai8n, i1l8n, i18om, activesupmport, brumdler, brundlef [2]. Security researcher Paul McCarty said these are not the SEO-tuned squats seen from other crews, such as events-channel imitating the Node.js events module, but "clumsy typos" [3]. Clumsy is not the same as ineffective. A fat-fingered gem name only has to survive one code review to reach a build agent.
The execution path is the part worth internalising. According to the researchers, the gems use an "extconf.rb" hook, which RubyGems runs automatically at install time and which normally configures native extensions in a package's "ext/" directory [4]. Here it fetches a 22 MB Rust loader from a GitHub release, which launches an embedded Go stealer called "wincfg"; the hosting account, github[.]com/bebraz1, is no longer reachable [5]. McCarty said StubMaker builds nothing: it emits a Makefile with empty all, install and clean targets plus Unix and Windows stub scripts that return success, so the extension phase reports a clean build while the beacon and loader fetch happen in the installer hook [6]. Anyone watching for compiler noise or build failures sees a green light.
The payload includes a DLL, "abe_payload.dll", used to pull credentials from Chromium-based browsers while circumventing the app-bound encryption protections Google added; the researchers list ten, including Chrome, Edge, Brave, Opera, Opera GX, Vivaldi, Yandex, Avast, AVG and CCleaner Browser [7][14]. It also takes extension data, browsing history, payment card numbers, cryptocurrency wallets and seed phrases, Telegram Desktop data and system information, and queries api.ipify[.]org for the public IP [8]. Collected data goes to Gofile as a password-protected ZIP, with the download link sent to "dresslee.com" over plain HTTP [9].
The registry mechanics are the durable lesson. The gems were published by accounts "mod8rz41mje" (Riley Miller) and "rbq95bwt6q" (Alex Davis), and have since been yanked [10]. In at least two cases, brumdler and brundlef, the actor exploited a known RubyGems behaviour that frees a namespace for anyone to claim once all versions of a gem are yanked; both had first been published by "gemlewqqhu1" (Taylor Moore) before the two accounts reclaimed them [11]. Jenn Gile, co-founder of OpenSourceMalware, told The Hacker News that the campaign was disrupted early but was made more effective by Ruby's "poor design choices" around name reuse and an unvalidated author field: yanking a gem let the actor create a new owner account and republish under the same name, so "what should have been forever dead was revived to compromise more people" [12]. Gile added that the actor set a different Author value per gem to make them look unrelated, because the Author field is unvalidated plaintext that need not match the owner [13].
Two things to watch. First, whether RubyGems changes the yank-and-reclaim behaviour, because until it does, takedown is not remediation and your allowlists cannot treat a name as permanently safe. Second, the npm side: the same disclosure window included a cluster of 21 npm packages typosquatting CLI binary names exposed by Google's scoped packages [15]. Install-time hooks remain the common denominator across both registries [4][15].
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence72
- Adoption15
- Hype gap+10
- Incentives40
- Confidence70
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
OpenSourceMalware discovered a typosquatting campaign targeting RubyGems users with a Windows-based information stealer on August 15, 2026, and tracks the threat under the moniker StubMaker.
- [2]
The campaign comprised 16 packages: ubnuler, ubnlder, ri18nr, reaker, rakier, orakw, joxn, ise18n, ioe18n, ie18u, iai8n, i1l8n, i18om, activesupmport, brumdler, brundlef. All appear to be typosquats of popular Ruby dependencies.
- [3]
Security researcher Paul McCarty said the packages are not the clever SEO-fueled typosquats seen from other threat actors, such as events-channel imitating the popular Node.js events module, but are "all clumsy typos".
- [4]
The attack chain uses an "extconf.rb" hook, which is run automatically when a user installs a gem, similar to npm lifecycle hooks; the file is typically used to configure native extensions written in C, C++ or Rust bundled in a package's "ext/" directory and compiled during installation.
- [5]
The Ruby hook fetches a 22 MB Rust-based loader from a GitHub release, which launches an embedded Go-based stealer payload named "wincfg". The GitHub account github[.]com/bebraz1 is no longer accessible.
- [6]
McCarty said StubMaker builds nothing: it generates a Makefile with empty all, install and clean targets, plus Unix and Windows stub scripts that do nothing but return success, so the extension phase reports a clean build while the platform beacon and Windows loader fetch and execution happen in the installer hook.
- [7]
The stealer incorporates a DLL payload, "abe_payload.dll", used to extract credentials from Chromium-based browsers by circumventing app-bound encryption (ABE) protections added by Google. The browsers named are Google Chrome, Microsoft Edge, Brave, Opera, Opera GX, Vivaldi, Yandex, Avast, AVG and CCleaner Browser.
- [8]
The stealer also collects extension data, browsing history and payment card numbers; searches for cryptocurrency wallets and seed phrases; extracts Telegram Desktop data; gathers system information; and requests api.ipify[.]org to obtain the victim's public IP address.
- [9]
Captured data is uploaded to Gofile as a password-protected ZIP archive, and the resulting download link is sent to the threat actor at "dresslee.com" over an unencrypted HTTP channel.
- [10]
The 16 gems were published by users named "mod8rz41mje" (aka Riley Miller) and "rbq95bwt6q" (aka Alex Davis). As of writing, the packages have been yanked from RubyGems.
- [11]
In at least two cases, brumdler and brundlef, the threat actor took advantage of a known RubyGems behavior that makes a namespace available for anyone to claim once all versions of a gem have been yanked; both packages were originally published by "gemlewqqhu1" (aka Taylor Moore) before being reclaimed by the two accounts.
- [12]
Jenn Gile, co-founder of OpenSourceMalware, told The Hacker News that although the campaign was disrupted fairly early, it became more effective because of Ruby's "poor design choices" via package name reuse and an unvalidated author field: "When one of the malicious gems was yanked, the threat actor was able to spin up a new owner account and publish a new malicious version under the same package name... What should have been forever dead was revived to compromise more people."
- [13]
Gile said the attacker assigned a different "Author" name to each gem to make them look unrelated even though they came from the same owner account, because the Author field is a totally unvalidated plaintext field that does not have to match the Owner.
- [14]
Ten Chromium-based browsers are named as targets.
- [15]
The disclosure coincided with two software supply chain campaigns targeting npm, including a cluster of 21 npm packages that typosquatted CLI binary names exposed by Google's scoped packages.
Sources
2 independent publishers whose own reporting we read for this story.
- OpenSourceMalware
opensourcemalware.com
1 article · August 18, 2026
- thehackernews.com16 Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets
1 article · August 18, 2026