Ruby Gems Suspends New Signups After Hundreds of Malicious Packages Are Uploaded
Summary: RubyGems paused new account signups after what Mend.io's Maciej Mensfeld called a "major malicious attack," with more than 120 malicious packages pulled and Ruby Central's Marty Haught describing a coordinated spam-publishing campaign limited to newly registered accounts. RubyGems said on May 13, 2026 that the bot accounts were blocked and removed and the 500+ malicious packages pushed during the attack were yanked, then reported on May 16, 2026 that the incident was resolved and registrations re-enabled, with WAF protection from Fastly and tighter rate limiting planned.
Bottom line: More than 500 junk packages reached the registry before being yanked, and the fix depended on blocking bot accounts and adding a WAF - controls that arrived after publication, not before. The source does not identify who was behind the attack.
Read the original at The Hacker News ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026