3 ms·
Did you catch where was this payload injected? Did they have write access to the rubygems.org source? It would seem if they did, they didn't need to write this
by timdorr 14y ago
Did you catch where was this payload injected? Did they have write access to the rubygems.org source? It would seem if they did, they didn't need to write this script at all and could simply read the configuration files directly.
- WestCoastJustin 14y agoAfter reading through the github.com issue posted in the comments, I get the impression this was targeted attack at rubygems.org (and not the user install base). There has been a tweet, also posted in the comments, suggesting that this was successful.
- Titanous 14y agoIt was in the gem metadata, which is YAML: https://gist.github.com/d891e876c53e55bf0920 https://gist.github.com/d891e876c53e55bf0920