RubyGems Are Now A Very Fancy Sieve

The GemStuffer campaign has managed to turn the RubyGems repository into a convenient courier service for exfiltrating data from U.K. council portals. By stuffing over 150 malicious gems into the system, the attackers have turned our beloved open-source dependencies into a very efficient plumbing leak. Protecting ourselves from this mess involves auditing the piles of code we blindly trust every single day, which sounds like a delightful way to spend a weekend. It is truly inspiring to see how many different ways a simple package manager can be used to ruin a perfectly good Tuesday.