Malicious RubyGems Packages Target Cryptocurrency Developers

Malicious packages published to RubyGems are deploying reverse shells and second-stage payloads targeting cryptocurrency developers. The campaign, attributed to a group called Ghost Dev, uses typosquatting to trick developers into installing malicious gems. Once installed, the packages open reverse shells and deliver additional payloads aimed at crypto wallets or development environments. The source reporting comes from SafeDep and open-source malware analysis.

This is a supply-chain risk for Ruby-based crypto tooling and any developer environment that pulls from RubyGems without strict verification. The reverse-shell mechanism gives attackers persistent remote access rather than one-time data theft, increasing potential for later-stage compromise. Monitor for new package names matching popular gems and check whether RubyGems has removed the malicious versions.