Sources allege that nonprofit Ruby Central took control of some Ruby open-source projects from their maintainers without consent, after pressure from Shopify
Ruby Central recently took over a collection of open source projects from their maintainers without their consent.
Joel Drapper
Context & Ripple Effects
The allegation puts governance, rather than a code vulnerability, at the center of Ruby’s project-risk story. Earlier reports of a backdoor found in 11 Ruby libraries and malicious packages on RubyGems showed how widely trusted dependencies can become a supply-chain exposure.
It also echoes the fragility exposed when a maintainer’s changes disrupted roughly 19,000 npm projects before GitHub intervened in the popular NPM-library corruption incident. The immediate question here is whether stewardship can be transferred without losing maintainer legitimacy.
First-order effects
Maintainers of the affected projects may lose practical authority over releases, access, and project direction if the alleged transfers stand; Ruby Central becomes accountable for those decisions.
Shopify’s reported pressure makes its relationship with Ruby Central and the affected maintainers a focal point for contributor trust, even though the reported claims remain allegations.
Second-order effects
Contributors and downstream users may reassess which Ruby projects have clear, consent-based governance, potentially shifting attention and contributions toward independently controlled forks or alternatives.
Ruby Central will face pressure to make project-control rules, maintainer recourse, and transfer processes legible; ambiguity can compound the dependency trust concerns raised by prior Ruby library compromise reporting.
Third-order effects
If major corporate users can influence stewardship changes at nominally independent open-source institutions, open-source governance may increasingly be judged by formal consent and accountability mechanisms, not nonprofit status alone.
The episode could sharpen a recurring structural tension: projects need durable institutional support, but centralization can weaken the maintainer autonomy that supplies their legitimacy unless governance safeguards are credible.
The trend: This is part of a broader shift in which open-source supply-chain resilience depends as much on transparent governance and maintainer consent as on code security.
Hey look, another corporate-sponsored takeover of an open-source ecosystem after WordPress last year.... The lawsuits from this should be glorious!!! [embedded post]
I really appreciate your post @apiguy.dev. Thank you for posting your thoughts. I wish you had the info I had to make your decision. — Here's the core issue: — Before Sept 9, when a trusted maintainer broke our shared contract and added an RC non-maintainer, you had no abil…
Yes, I agree. And some of the “admins” even announced publicly many days ago they were launching a competitor tool and were funding raising for it. I'd not trust the system to such “admin”.
it's emerging still but i'd also point to the rubygems hostile takeover which is happening pretty much the same way automattic took over those WP plugins. this is more developer skewed but it's reminiscent of WP/automattic with shopify's looming presence & will have long term imp…
this is by far the most detailed timeline and description of what's been happening with RubyGems.org and Ruby Central, apparently with multiple insider sources, and it all looks _incredibly_ damning
Hi! Since this thread is being shared a lot right now, I recommend reading this: joel.drapper.me/p/rubygems-t... It turns out, apparently, I was very out of the loop and things were somehow worse than I thought.
If these facts are accurate, in my layperson's opinion, I believe Ruby Central has violated their obligations as a 501c3 charity. It appears they are acting in the interest of a significant donor and not towards a charitable purpose. — joel.drapper.me/p/rubygems-t...
Freedom, another member of the Ruby Central Board, wrote this post, but it closely aligns with my feelings and experiences as well. — apiguy.substack.com/p/a-board- me...
When considering any incident it is valuable to consider all perspectives and remember that at the end of the day we all love ruby and want it to succeed. — apiguy.substack.com/p/a-board- me...
Shopify, pulling strings at Ruby Central, forces Bundler and RubyGems takeover https://joel.drapper.me/... Ruby Central recently took over a collection of open source projects from their maintainers without their consent. News of the takeover was first broken by Ellen on 19 Sept…