Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets

Cybersecurity researchers have discovered a new typosquatting campaign targeting RubyGems users with a Windows-based information stealer. The campaign, dubbed StubMaker, has been tracked by OpenSourceMalware and has been found to harvest browser credentials, cryptocurrency wallets, seed phrases, and Telegram data.

The campaign involves 16 typosquatted RubyGems packages, including ubnuler, ubnlder, ri18nr, reaker, rakier, orakw, joxn, ise18n, ioe18n, ie18u, iai8n, i1l8n, i18om, activesupmport, brumdler, and brundlef. These packages were published by users named "mod8rz41mje" (aka Riley Miller) and "rbq95bwt6q" (aka Alex Davis).

The malicious packages were designed to take advantage of a known RubyGems behavior that makes a namespace available for anyone to claim once all versions of a gem have been yanked. In at least two cases, the threat actor has been found to take advantage of this behavior to publish new malicious versions of the packages.

The attack chain involves an "extconf.rb" hook to trigger the execution of a Rust-based loader, which in turn launches a Go-based stealer payload. The stealer incorporates a DLL payload that extracts credentials from Chromium-based web browsers, collects extension data, browsing history, and payment card numbers, and searches for cryptocurrency wallets and seed phrases.

The campaign has also been observed targeting npm with a set of 37 packages that make use of a postinstall hook to retrieve a GitHub-hosted Windows loader, which then unpacks a Go infostealer targeting browser credentials and sessions, payment-card data, cryptocurrency wallets and seed phrases, Telegram data, and host information.

The names of the typosquats are below:

| Package Name | Description | | --- | --- | | axois-http, axious-core | Typosquats of axios | | chalk-core, chalk-lib, chalk-util, chalk-es | Typosquats of chalk | | comand, comander-cli, comanderjs, commandorjs, commandor-cli, commandor-core, comander-lib, commandor-lib, commander-lib | Typosquats of commander | | loadashjs, lodash-lib, ladash-cli, lodahsjs, lodsh-cli, lodahs-cli, lodhash-cli | Typosquats of lodash | | typescirpt-cli, typscript-cli, typesript-cli, typscript-core, typescriptt-cli, typescrip-cli, typescipt-cli, tyepescript-cli, typescirpt-core, tyepescript-core, typesript-core, typescipt-core, typescriptt-core | Typosquats of typescript | | raectjs | Typosquat of react |

The disclosure coincides with the discovery of two software supply chain campaigns targeting npm, including a cluster of 21 npm packages that typosquatted CLI binary names exposed by Google's scoped packages to deliver a minimal postinstall beacon, and a cluster of Baileys npm forks that engage in a variety of malicious behaviors.

As with the malicious RubyGems, the npm packages are typosquats of popular packages such as axios, chalk, commander, lodash, typescript, and react. None of the packages are available for download as of writing.

OpenSourceMalware has also flagged some key differences between the two campaigns, including the use of "extconf.rb" hooks in the Ruby installer and postinstall hooks in the npm packages, and the use of Base64 decoding in the Ruby installer and repeated-key XOR with a hard-coded key in the npm installer.

The campaign has been observed targeting both RubyGems and npm, with the threat actor using a single payload and a single C2 backend for both campaigns. The campaign has been rapidly discovered and removed, with the threat actor adapting and returning to publish new malicious versions of the packages.

The disclosure highlights the importance of continuous monitoring of package ecosystems and the need for developers to be aware of the risks of typosquatting and software supply chain attacks.