RubyGems, the standard package manager for the Ruby programming language, has temporarily disabled new account registration following what has been described as a major malicious attack involving hundreds of packages.
Visitors attempting to create a new RubyGems account are now shown a message stating that new account registration has been temporarily disabled. The move appears to be a defensive measure while RubyGems and its security partners work to contain the incident.
The full scope of the attack is still developing, and the identity of the threat actor is currently unknown. Mend.io, which supports RubyGems security, said more details will be released once the incident is contained.
What Happened?
According to Maciej Mensfeld, senior product manager for software supply chain security at Mend.io, RubyGems is dealing with a large-scale malicious activity campaign. Mensfeld said that signups were paused and that hundreds of packages were involved, with some reportedly carrying exploits.
A later public post from Mensfeld indicated that more than 120 malicious packages had been pulled from RubyGems, and that the campaign appeared to target RubyGems itself through techniques such as cross-site scripting and data exfiltration, rather than only targeting end users.
This is important because it suggests the attack may not have been limited to publishing malicious packages for developers to install. Instead, the attackers may have attempted to abuse the package ecosystem and the platform itself.
Why RubyGems Matters
RubyGems is a critical part of the Ruby ecosystem. Developers use it to install, publish, and manage Ruby packages, including libraries used in web applications, automation scripts, DevOps tooling, and production systems.
When a package manager is targeted, the risk extends far beyond one developer account. A malicious package can potentially reach:
- developer workstations
- CI/CD pipelines
- build servers
- application environments
- cloud deployments
- production systems
This is why attacks against package ecosystems are so serious. They can turn trust in open-source dependencies into a distribution channel for malware, credential theft, or further compromise.
The Growing Threat to Open-Source Supply Chains
The RubyGems incident is part of a wider trend: attackers are increasingly targeting open-source package repositories because they offer scale and trust.
Instead of attacking one company directly, threat actors can compromise or impersonate a package, upload malicious dependencies, abuse typo-squatting, or target maintainers. If successful, the malicious code may be pulled automatically into many downstream environments.
Recent campaigns across ecosystems such as npm, PyPI, and RubyGems have used techniques including:
- malicious package uploads
- dependency confusion
- typo-squatting
- brandjacking
- credential-stealing malware
- fake developer tooling
- malicious install scripts
- data exfiltration from build environments
In previous RubyGems security incidents, malicious packages were removed and associated accounts were terminated after suspicious behavior was detected. RubyGems has also previously emphasized the importance of ecosystem monitoring and coordinated response when malicious packages are identified.
Why Attackers Target Developers
Developers are high-value targets because their systems often contain credentials and access tokens that can unlock much more than source code.
A compromised developer or CI/CD environment may expose:
- GitHub or GitLab tokens
- RubyGems publishing credentials
- cloud keys
- SSH keys
- API tokens
- database credentials
- CI/CD secrets
- production deployment access
Once stolen, these credentials can be used to publish more malicious packages, compromise repositories, access infrastructure, or support ransomware and data theft campaigns.
Google has warned that credentials stolen from software supply chain attacks are being monetized through partnerships with ransomware and data extortion groups, making these incidents part of a much larger cybercrime economy.
What Developers Should Do Now
Ruby developers and organizations using RubyGems should treat this incident as a reminder to review dependency and credential hygiene.
Recommended actions include:
- avoid installing newly published or unfamiliar gems until more details are available
- review recent gem additions and dependency updates
- check CI/CD logs for unexpected package installs or script execution
- pin dependency versions where possible
- verify package names carefully to avoid typo-squatting
- audit RubyGems API keys and rotate them where appropriate
- enforce MFA on RubyGems and source control accounts
- avoid storing long-lived secrets in local developer environments
- use secret scanning across repositories and build logs
- monitor for unexpected network connections during builds
- review packages for suspicious install hooks or obfuscated code
Organizations should also consider using internal package mirrors, dependency allowlists, and software composition analysis tools to reduce exposure to malicious packages.
What Maintainers Should Review
Open-source maintainers should also take immediate precautions.
Maintainers should:
- confirm that RubyGems account MFA is enabled
- rotate publishing tokens if suspicious activity is detected
- review recently published versions for unexpected changes
- check collaborator permissions
- verify release automation and CI/CD secrets
- monitor for fake packages using similar names
- publish advisories quickly if compromise is suspected
Package maintainers are increasingly targeted because a single trusted package can provide attackers with access to thousands of downstream users.
Final Thoughts
The RubyGems signup pause shows how serious open-source supply chain threats have become. Package repositories are no longer just developer convenience platforms — they are critical infrastructure for modern software delivery.
While the full details of this incident are still emerging, the message is clear: attackers continue to target the trust layer of software development.
For developers, security teams, and maintainers, this is the right time to review dependencies, rotate sensitive credentials, enforce MFA, and monitor build environments closely.
Open-source ecosystems remain essential, but they must be treated with the same security discipline as production infrastructure.
