Socket analyzed malicious RubyGem strutil-core 1.0.1, whose install hook runs a worm that steals credentials, spreads across package registries and poisons…

A Supply-Chain Attack Turns a Ruby Package Into a Self-Propagating Threat A malicious Ruby package named strutil-core version 1.0.1 has been analyzed by Socket, revealing a supply-chain attack designed to steal credentials, spread across software package registries, and compromise AI-assisted development environments. The discovery highlights an increasingly dangerous trend: malicious packages are no longer limited to stealing developer secrets. They are also targeting the interconnected tools, registries, and AI-powered systems that developers rely on to build and maintain software.

A malicious Ruby gem runs a credential-stealing worm during installation, poisons AI coding tools, and can wipe files when a stolen GitHub token is revoked.

Security updates have been issued by **AlmaLinux** (cockpit, dpdk, fence-agents, firefox, freerdp, gimp, opentelemetry-collector, python-dns, qemu-kvm, and raptor2), **Debian** (apt and squid), **Fedora** (ags, apptainer, chromium, fractal, mingw-harfbuzz, mingw-qt5-qtwebkit, mingw-qt6-qt5compat, python-mistune, python3-docs, python3.14, python3.9, rubygem-gist, rust-app-store-connect, rust-qemu-rdp, rust-redlib, and selenium-manager), **Mageia** (java-latest-openjdk, java-17-openjdk, java-21-openjdk, timezone), **Oracle** (.NET 10.0, .NET 8.0, .NET 9.0, bind, bind9.16, cockpit, firefox, freerdp, gcc, ghostscript, glibc, grafana, java-17-openjdk, java-21-openjdk, kernel, kernel-uek, libXi, pipewire, pki-deps:10.6, podman, python-jwt, python-pillow, python-pyasn1, qt5-qtbase, thunderbird, tomcat, util-linux, and wireshark), **Red Hat** (dnsmasq, fence-agents, freerdp, pki-core:10.6, and thunderbird), **SUSE** (amazon-ssm-agent, aom-tools, apache2, brotli, cadvisor, chromium, cups, curl, distribution-registry, eog, gh, go-containerregistry, google-guest-agent, gvfs, haproxy, hauler, helm3, kernel, libBasicUsageEnvironment2, libcdio, libinstpatch-1_0-2, libosmocore, libreoffice, libX11, nodejs22, nvidia-open-driver-G06-signed, openssh, parted, perl-DBI, perl-mime-tools, python-pypdf, rootlesskit, rqlite, rsyslog, sssd, tomcat10, warewulf4, and xen), and **Ubuntu** (apt-cacher, bind9, bitlbee, cakephp, deluge, dmitry, e17, feh, gnome-shell, golang-github-gin-contrib-cors, gvfs, haproxy, jabberd2, libmspack, libnet-easytcp-perl, libphp-swiftmailer, libsoup2.4, libsoup3, libuser, pcre2, rear, ruby-rack, ruby-sprockets, rxvt-unicode, shapelib, sogo, vips, and yaws).

Performance regressions in Bundler and RubyGems usually surface only after a release, and comparing two commits by hand depends on the network and a lot of care. tool/bench/run.rb measures install,...

Contribute to afomera/hanami-turbo development by creating an account on GitHub.

The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because http_connection in lib/gist.rb sets VERIFY_NONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth tokens and login credentials to read and modify the victim's gists.

The gist RubyGem versions from 4.0.0 up to but not including 6.1.0 contain an improper certificate validation vulnerability. The vulnerability arises because the http_connection method in lib/gist.rb sets SSL verification to VERIFY_NONE, ef

Summary This branch implements ~35 performance optimizations to Bundler's installation pipeline, inspired by tenderlove's blog post and by studying uv's actual source code architecture....

Researchers linked OpenAI agents to RubyGems abuse and alleged RubyDoc RCE, highlighting risks around autonomous AI, build systems, and credentials. OpenAI agents are linked to more than 2,000 RubyGem...

A flaw was found in the foreman_ansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not enforce the search filter associated with the caller's view_hosts permission. An authenticated user whose host visibility is restricted by a permission filter can supply arbitrary …

Release video for Glimmer DSL for Web (Award-Winning Frontend Framework for Ruby on Rails) 0.10.5 Before & After Mutations. Glimmer DSL Web Release Version 0.10.5 GitHub : GitHub - AndyObtiva/glimmer-dsl-web: Glimmer DSL for Web (Ruby-in-the-Browser Web Frontend Framework). The "Rails" of Frontend Frameworks!!! · GitHub RubyGem : glimmer-dsl-web | RubyGems.org | your community gem host Blog Post : Code Master Blog: Video: Glimmer DSL for Web 0.10.5 Before & After Mutations ··· (click for more details)

Release video for Glimmer DSL for Web (Award-Winning Frontend Framework for Ruby on Rails) 0.10.5 Before & After Mutations. Glimmer DSL Web Release Version 0.10.5 GitHub : GitHub - AndyObtiva/glimmer-dsl-web: Glimmer DSL for Web (Ruby-in-the-Browser Web Frontend Framework). The "Rails" of Frontend Frameworks!!! · GitHub RubyGem : glimmer-dsl-web | RubyGems.org | your community gem host Blog Post : Code Master Blog: Video: Glimmer DSL for Web 0.10.5 Before & After Mutations ··· (click for more details)

Release video for Glimmer DSL for Web (Award-Winning Frontend Framework for Ruby on Rails) 0.10.5 Before & After Mutations. Glimmer DSL Web Release Version 0.10.5 GitHub : GitHub - AndyObtiva/glimmer-dsl-web: Glimmer DSL for Web (Ruby-in-the-Browser Web Frontend Framework). The "Rails" of Frontend Frameworks!!! · GitHub RubyGem : glimmer-dsl-web | RubyGems.org | your community gem host Blog Post : Code Master Blog: Video: Glimmer DSL for Web 0.10.5 Before & After Mutations ··· (click for more details)