RubyGems Suspends New Signups After Hundreds of Malicious Packages Are Uploaded
RubyGems has temporarily disabled new account registrations after attackers uploaded hundreds of malicious packages and launched a DDoS campaign against the popular Ruby package registry.
RubyGems, the central package registry for the Ruby programming language, suspended new account registrations on May 12, 2026, after attackers uploaded hundreds of malicious packages in what security researchers are calling a coordinated supply chain attack.
The platform’s status page confirms the protective measure: “Due to an ongoing DDoS attack against rubygems.org, we have temporarily disabled registrations. We’ll share an update once we’ve made changes to protect legitimate users and prevent further abuse.” Despite the registration freeze, core gem download and API services have remained operational.
What Happened
Maciej Mensfeld, senior product manager for software supply chain security at Mend.io — the company that manages security for RubyGems — confirmed the incident on social media ↗: “We’re dealing with a major malicious attack on Ruby Gems right now. Signups are paused for the time being.”
The attack combined two tactics. Threat actors first bulk-created accounts and flooded the registry with hundreds of malicious gem uploads. Several of those packages contained active exploits, according to initial analysis. A DDoS component ran alongside the package uploads, adding load pressure to a registry already scrambling to triage inbound submissions.
Mend.io said it would release additional technical details once the incident was contained.
Scale and Targeting
The packages were not random. Researchers noted that a disproportionate number appeared to target Mend.io directly — either as a probe of the security vendor’s own detection pipeline or as a deliberate attempt to overwhelm the team responsible for policing the registry. The exact payload types and whether any downstream developers were affected have not been publicly confirmed as of this writing.
RubyGems.org’s status dashboard ↗ shows core infrastructure holding up through the incident: gem downloads and the dependency API have both maintained 100% uptime over the trailing 90 days, and application availability has been 99.96% in the same window. The attacker’s apparent goal was disruption of onboarding and abuse of the registration pipeline, not a takedown of gem serving.
Package Registry Attacks Are Accelerating
This is not RubyGems’ first encounter with malicious packages. In 2020, the registry was used to distribute over 760 gems containing reverse-shell and data-exfiltration payloads, eventually prompting a forced password reset for a large portion of users.
The broader trend is well-documented. Open-source package registries — npm, PyPI, crates.io, and RubyGems among them — have become a favored attack surface because the trust model is inherently permissive. Any registered user can publish a package, and automated dependency resolution means a single malicious upload can propagate to thousands of downstream builds before detection catches it.
Tactics have matured alongside the opportunity. Typosquatting on popular gem names, dependency confusion attacks (publishing a public gem with the same name as a private internal dependency), and account takeover of legitimate publishers are all documented techniques. The May 12 incident appears to lean on volume rather than stealth: bulk-creating accounts and flooding the registry to either overwhelm manual review or probe for gaps in automated scanning.
Operational Implications for Ruby Developers
For teams relying on RubyGems in their CI/CD pipelines, the immediate risk is less about the attack itself and more about what it surfaces. A few practical steps worth reviewing:
Lock your Gemfile. Gemfile.lock pins exact versions and checksums. Pinning prevents a newly published malicious version of a dependency from being silently pulled in on the next bundle install. If your lock file is not committed and enforced in CI, now is the time to fix that.
Enable signature verification where possible. RubyGems supports gem signing and SHA-256 checksum verification. Adoption remains low across the ecosystem, but the tooling exists. gem install --trust-policy HighSecurity enforces signature requirements for gems that support it.
Audit new transitive dependencies. Tools like bundler-audit check your installed gems against known vulnerability databases. Running it in CI catches known-bad gems; it does not catch novel malicious packages, but it raises the floor.
Watch for dependency confusion candidates. If your organization uses private gems, verify their names do not collide with anything published to the public registry. Attackers have used this technique to intercept internal dependency resolution in npm and PyPI environments.
Monitor Mend.io’s follow-up disclosure. The company has signaled a post-incident technical report. That disclosure will clarify payload types, affected gem names, and whether any packages slipped through automated scanning before removal. Subscribing to RubyGems security advisories at rubygems.org/pages/security ↗ is worth doing regardless.
What RubyGems Has Said
As of publication, RubyGems’ public communication has been limited to the status page incident update. The sign-up page displays a notice that new registrations are temporarily unavailable. Mend.io has promised additional details but has not yet published them.
The speed of the response — pausing registrations within hours of the attack being identified — is the right reflex. Open registries face a structural tension: lowering friction for legitimate contributors versus raising it for abusers. When that balance tips toward mass abuse, pulling the registration lever is the least-damaging short-term option.
The harder question is what comes next. Verification requirements, rate limiting on account creation, and stricter automated scanning are standard responses to these incidents. Whether RubyGems implements any of them will become clearer once Mend.io publishes its post-incident analysis.
Sources
- The Hacker News — RubyGems Suspends New Signups After Hundreds of Malicious Packages Are Uploaded ↗. Primary reporting on the incident with quotes from Mend.io’s Maciej Mensfeld.
- RubyGems.org Status Page — Temporarily Disabling New User Registrations ↗. Official incident record from the RubyGems team confirming the registration suspension and DDoS component, with service uptime data.
Sources
Tech Sentinel — in your inbox
Cybersecurity news, daily — breaches, CVEs, ransomware, threat actors, and the patches that matter. — delivered when there's something worth your inbox.
No spam. Unsubscribe anytime.
Related
How AI Fraud Detection Works: Techniques, Trade-offs, and What's Next
AI fraud detection systems catch 70–90% more suspicious activity than rules-based methods. Here's how machine learning, graph neural networks, and behavioral analysis work — and where the structural gaps remain.
Machine Learning Security: Key Threats, Attack Types, and Defenses
Machine learning security covers adversarial attacks, data poisoning, model theft, and supply chain risks targeting ML systems. Here is what practitioners need to know.
Generative AI Risks: A Practitioner's Guide to What Actually Matters
From prompt injection to supply chain poisoning, the generative AI risk landscape is broader than most security teams realize. Here is what the frameworks say and what attackers are doing.