RubyGems team found a backdoor in 11 Ruby libraries, including rest-client, that could leak data and issue commands remotely, say it was abused for cryptomining
Context & Ripple Effects
The RubyGems repository has become a repeat target rather than a one-off victim: this backdoor in 11 libraries, including the widely used rest-client, foreshadows the far larger campaign uncovered less than a year later when researchers found 725 malware-laden Ruby libraries on the same official registry, many built to hijack clipboards and redirect bitcoin payments.
The monetization angle is also familiar ground — the cryptomining abuse here extends a pattern already seen when 350+ Drupal sites were caught serving mining scripts after severe flaws were published, showing attackers consistently converting code-distribution weaknesses into coin.
First-order effects
- Any application depending on rest-client or the other ten trojanized libraries is exposed to data leakage and remote command execution until maintainers audit their dependency trees and pull clean versions.
- The RubyGems team is forced into reactive takedowns and advisories across all 11 packages at once, since the backdoor sat on the official registry itself rather than a mirror.
Second-order effects
- Attackers demonstrably iterate on what works here: the follow-on clipboard-hijacking wave across 725 gems shows adversaries refining payload choice from generic mining toward direct theft of bitcoin transactions.
- Infrastructure adjacent to package ecosystems inherits the same abuse model — researchers later documented cryptominers being planted through GitHub Actions, with GitHub investigating its own server infrastructure.
Third-order effects
- If the pattern holds, open-source registries stop being trusted infrastructure by default and dependency auditing, integrity verification, and provenance checks become standard engineering practice rather than optional hygiene.
- Cryptomining as the default monetization layer for compromised code pipelines pushes both registries and hosting platforms like GitHub toward continuous abuse detection as a core operating cost.
The trend: Software supply chain attacks are escalating from isolated backdoors in individual packages to industrial-scale campaigns against entire package registries, with cryptomining as the reliable payout.