StubMaker is a malicious gem cluster that installs a multi-stage Windows infostealer malware, harvesting browser credentials, cryptocurrency wallets, seed phrases, and Telegram data. The cluster contains more than 4,000 malicious typosquats of popular Ruby gems. The malicious gems include an extconf.rb hook that triggers downloader functionality located in runner.rb or compat.rb files. The second stage Rust loader is downloaded from a release artifact hosted on threat actor-controlled GitHub repository. Small number of npm packages have also been identified as part of this campaign.