RubyGems and npm Ecosystems — “StubMaker” Typosquatting Campaign Deploys Windows Infostealer (CWE-506 / N/A)

Publication date: August 18, 2026
Category: Cybersecurity / Software Supply Chain

Introduction

Cybersecurity researchers at OpenSourceMalware and SafeDep have uncovered a malicious software supply chain campaign simultaneously targeting the RubyGems and npm package registries. Tracked under the moniker StubMaker (and later associated with variants like BRIDGEHEAD), the operation utilized typosquatting techniques mimicking popular development dependencies. Attackers published at least 16 malicious packages on RubyGems and dozens of fraudulent libraries on npm designed to silently deploy a Rust-based loader and a Go infostealer payload on Windows systems, compromising developer credentials, messaging data, and cryptocurrency wallets.

What is StubMaker / BRIDGEHEAD? (General Analysis)

StubMaker does not represent a traditional software source code vulnerability, but rather an active software supply chain attack via fraudulent typosquatted packages. Threat actors weaponized common developer typos when installing third-party dependencies, alongside inherent architectural weaknesses in repository metadata management (such as unvalidated author fields and the reuse of namespaces from previously yanked or deleted packages).

Although the core risk stems from the automatic execution of scripts during the package installation phase, the flaw is technically classified under CWE-506: Embedded Malicious Code. As no official CVE has been assigned by the NVD for this supply chain incident, a reasoned CVSS v3.1 score of 8.8 (High) is estimated with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, given that it requires user interaction (installing the package) but grants full code execution privileges on the developer’s host.

How Does It Work? (Technical Analysis)

The attack chain differs slightly across package ecosystems but converges on downloading the exact same secondary payload targeting Windows operating systems:

  • Initial Infection Flow in RubyGems: The fraudulent packages utilize an extconf.rb configuration script. This file is executed completely automatically when a user invokes the package installation command (gem install). Instead of compiling legitimate native extensions in C or Rust, the fake script generates an empty Makefile and stub success codes to report a clean build while background routines decode (via Base64) and fetch an external Rust-based loader hosted on GitHub.
  • Initial Infection Flow in npm: Concurrently, the npm ecosystem was targeted via 37 packages leveraging postinstall lifecycle hooks, which employ repeated-key XOR obfuscation with hard-coded keys to retrieve the same Windows loader. Subsequent variants analyzed by CloudSEK (tracked under BRIDGEHEAD) implemented a Windows Subsystem for Linux (WSL) gate, treating developers running installation scripts inside Linux environments as a bridge to reach the underlying Windows host.
  • Payload Execution and Exfiltration: The Rust loader drops a Go-based DLL payload (abe_payload.dll). This component bypasses Chromium’s App-Bound Encryption (ABE) protections to extract stored credentials, browsing histories, cookies, payment cards, crypto wallet seed phrases, and Telegram Desktop data. The harvested information is bundled into a password-protected ZIP archive and transmitted via unencrypted HTTP channels to public file-hosting services and attacker-controlled command and control (C2) infrastructure.

Affected Systems / Environments

The threat directly impacts software developers and engineers operating on Windows-based development environments (or WSL environments) who inadvertently install typosquatted dependencies. Impacted components include:

  • RubyGems Ecosystem: 16 identified malicious packages, including ubnuler, ubnlder, ri18nr, reaker, rakier, orakw, joxn, ise18n, ioe18n, ie18u, iai8n, i1l8n, i18om, activesupmport, brumdler, and brundlef.
  • npm Ecosystem: Multiple clusters of fraudulent packages mimicking massive dependencies such as axios (e.g., axois-http, axious-core), chalk, commander, lodash, typescript (including variants detected by CloudSEK such as typecript-cli, typecript-core, typescrit-cli), and react.
  • Targeted Platforms: 64-bit Windows development workstations and WSL distributions with access to local Chromium-based browsers and cryptocurrency software.
Component / PackageCategory (CWE)ImpactCVSS (Estimated)Vector (Estimated)
RubyGems (StubMaker)CWE-506 (Malicious Code)Credential & Crypto Theft8.8 (High)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
npm Packages (Typosquatting)CWE-506 (Malicious Code)Loader Execution & Exfiltration8.8 (High)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
BRIDGEHEAD (WSL Gate)CWE-506 (Malicious Code)Cross-Environment WSL-Windows Breach8.8 (High)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Mitigation and Detection

Remediation

  • Immediate Host Isolation: If the installation of any listed package is suspected on a Windows machine during the active window, immediately isolate the host from the corporate network.
  • Massive Credential Rotation: Revoke and rotate all cloud service access keys, browser credentials, API keys, and cryptocurrency seed phrases associated with the impacted machine.
  • Dependency Purging: Audit Gemfile.lock and package-lock.json files for unfamiliar entries or typographical variants and clear package manager local caches.

Detection

  • Process and Hook Monitoring: Audit the execution of automated build scripts within package directories (extconf.rb in Ruby and lifecycle hooks in npm).
  • Network Indicators: Monitor unauthorized outbound connections to temporary file-hosting services (such as Gofile) or external queries to IP geolocation services (api.ipify.org) initiated by dependency build processes.

“The campaign demonstrated how threat actors can exploit package namespace recycling policies and native installation hooks to execute complex payloads in developer environments without requiring traditional software vulnerabilities.”

Wrapping Up

The StubMaker campaign and its npm counterpart underscore the critical risks inherent in the open-source software supply chain. By leveraging typosquatting and exploiting legitimate package manager behaviors —such as installation hooks and the recycling of yanked package names— threat actors successfully deployed infostealers capable of ransacking developer workstations. This incident highlights the urgent need for strict repository security controls, dependency verification, and development environment isolation.

References