Threat actors have uploaded more than 500 malicious or junk packages to RubyGems.org.

Threat actors uploaded more than 500 malicious or junk packages to RubyGems.org, prompting maintainers to suspend new account registrations. The attack involved bot‑driven spam activity and attempts at XSS and data exfiltration, though existing packages were not compromised. RubyGems maintainers described the event as a DDoS‑like overload and expect registrations to remain closed for several days while protections are strengthened. Investigators currently believe the attackers targeted RubyGems itself rather than end users.

Read more:

https://www.securityweek.com/hundreds-of-malicious-packages-force-rubygems-to-suspend-registrations/