Follow-up and Clarification on Recent Malicious Ruby Gems Campaign

On August 7, 2025, we published threat research about a coordinated campaign involving 60 malicious Ruby gems. In that article, we highlighted the technical details of the malware and warned developers about the risks these gems posed.

Since then, we’ve had constructive conversations with the RubyGems.org security team, and we want to take a moment to clarify and correct the record.

Updating the Record#

In our research, we described the malicious gems as having been “yanked by the author,” i.e. the threat actor. This phrasing was based on how the RubyGems.org website presented the removal information at the time. The website explicitly stated: “This gem previously existed, but has been removed by its owner” for the affected gems.

After speaking with the RubyGems.org security team, they clarified that another vendor, Mend.io, had also detected some of these malicious gems, and the team was in the process of removing them.

By relying on the automated gem status presented on the website, we unintentionally overlooked the important and proactive role their team played in protecting developers and the ecosystem. This gave too much credit to the threat actor, when it was the RubyGems.org security team that had been yanking the gems, even though the website stated that it was the gems’ author.

The RubyGems.org security team deserves recognition for their quick action and ongoing vigilance. Their work often happens behind the scenes, but the impact is felt widely by developers who rely on them to keep the Ruby ecosystem safe.

Moving Forward Together#

This experience is a reminder that security in open source is a shared responsibility. At Socket, we’re committed to working collaboratively with ecosystems like RubyGems.org, and all the other ecosystems we support, to share intelligence, respond to incidents, and keep communities informed.

We’re grateful to the RubyGems.org team for the thoughtful and open conversation we had following our post, and we look forward to further collaboration. By working together, we can better protect developers and strengthen the resilience of open source software supply chains.