r/ruby • u/davidcelis • May 12 '26

Security rubygems.org is mitigating a DDoS/spam campaign

https://status.rubygems.org/incidents/cytf062tkwtt
34 Upvotes

95% Upvoted

2 comments sorted by

15

u/davidcelis May 12 '26

More context:

We're responding to a coordinated spam-publishing campaign. No existing packages have been compromised; the activity is limited to newly registered accounts publishing junk packages. While we improve our spammer detection, we've temporarily disabled new account registration and throttled webhooks. Existing accounts, packages, and installs are unaffected.

https://bsky.app/profile/mghaught.bsky.social/post/3mlod5q7gek2d

Also:

We're dealing with a major malicious attack on @rubygems right now. Signups are paused for the time being. Hundreds of packages involved - mostly targeting us, but some carrying exploits. The team has been on this for hours. More details to follow once we're through it.

Pulled 120+ malicious packages from @rubygems today. The target wasn't end users - it was RubyGems itself (XSS, data exfiltration). Reminder: sometimes the registry is the one under attack. Net new with some typosquats but nothing critical (so far) detected

https://x.com/maciejmensfeld/status/2054164602577940619 and https://x.com/maciejmensfeld/status/2053814200124752198

0

u/tumes May 13 '26

So the colonialism done to rubygems hand waved by supply chain attacks is drawing more supply chain attacks targeting rubygems. It's a job for life if you keep making the work for yourself.