16 Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets

Cybersecurity researchers have flagged a new typosquatting campaign targeting RubyGems users with a Windows-based information stealer. OpenSourceMalware, which discovered the activity on August 15, 2026, is tracking the threat under the moniker StubMaker. The complete list of packages published as part of the campaign is below - ubnuler ubnlder ri18nr reaker rakier orakw joxn

Factually reported: Researchers identified a typosquatting campaign in RubyGems where multiple malicious packages (e.g., ubnuler, ubnlder, ri18nr, reaker, rakier, orakw, joxn) deliver a Windows information stealer that targets browser credentials and crypto wallets. This shows active compromise of a widely used open-source package ecosystem, affecting downstream developers and applications that depend on RubyGems. RealGround analysis: Such attacks highlight AI supply chain exposure when AI agents or AI-powered services automatically fetch, build, or run code from public registries without strong provenance checks. Organizations should strengthen their AI supply chain governance, SBOM practices, and readiness assessments so that any AI systems interacting with developer ecosystems do not implicitly trust third‑party packages and have controls to detect tampered or malicious dependencies.