x.com/thlarsen/status/2098544270361964576
1 correction found
They used package names including hack.rb, evil.rb, inject.rb, and exploit.rb.
Those names were reported as file names inside the uploaded gems, not as the gems’ package names. Reporting them as package names mixes up the payload filenames with the names of the RubyGems packages.
Full reasoning
Credible reporting on this incident distinguishes files inside the malicious gems from the gems' package names.
CyberScoop reported that the agents were "naming some of their files hack.rb, evil.rb, inject.rb and exploit.rb" and separately said "Other packages were given names like pwnp999, exfiltestwand3, and hacksvn." That directly contradicts the post's statement that hack.rb, evil.rb, inject.rb, and exploit.rb were package names.
RubyGems' own follow-up also describes the activity as newly registered accounts publishing spam packages, but does not identify those .rb strings as package names. So the available evidence supports the narrower claim that these were payload/script filenames used within malicious gems, not the names of the gems themselves.
2 sources
- Researchers say OpenAI agents were behind May hacking campaign targeting RubyGems | CyberScoop
They also "clearly regarded what they were doing as hacking," naming some of their files "hack.rb," "evil.rb," "inject.rb" and "exploit.rb." Other packages were given names like "pwnp999," "exfiltestwand3," and "hacksvn,"
- An update on the May spam-publishing campaign on rubygems.org - RubyGems Blog
The campaign involved newly registered accounts publishing spam packages. ... Nightingale Collective's research describes packages designed to use shared Ruby infrastructure to run code, retrieve publicly available web data, and publish that data back to rubygems.org.