16 Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets

Cybersecurity researchers have identified a typosquatting campaign targeting RubyGems users with a Windows-based information stealer. The campaign, tracked as StubMaker, was discovered on August 15, 2026, by OpenSourceMalware. The threat involves 16 typosquatted packages, including ubnuler, ubnlder, ri18nr, reaker, rakier, and orakw, among others. These packages are designed to steal browser credentials and crypto wallets. The packages are likely intended to be confused with legitimate RubyGems packages due to their similar names. The discovery highlights a new threat to RubyGems users.