Cryptojacking Campaign Exploits RubyGems with 136 Malicious Packages

A supply chain attack has compromised RubyGems with 136 malicious packages that deploy an XMRig Monero miner. This attack leverages SSH to propagate itself, affecting developer machines and consuming their computing resources. Researchers documented the campaign on July 22, 2026, revealing systemic vulnerabilities in the Ruby ecosystem. The malicious packages can significantly slow down development work while generating cryptocurrency for the attackers. The incident highlights the need for enhanced security measures in software package management systems. Developers using RubyGems are at risk of having their machines hijacked for cryptomining, leading to potential financial losses and productivity issues. The attack emphasizes the importance of vigilance in reviewing package dependencies and the security of development environments.

Key Points: • 136 malicious RubyGems packages have been identified, deploying XMRig miners. • The attack spreads through SSH, affecting developer machines and slowing down operations. • Researchers documented the campaign on July 22, 2026, highlighting systemic vulnerabilities.