x.com/thlarsen/status/2098544270361964576
1 correction found
They used package names including hack.rb, evil.rb, inject.rb, and exploit.rb.
Those strings were file names inside the uploaded gems, not the gems’ package names. The actual package names shown in the public diffs were names like southpxdatapp6pi, lambethcalcqzewgt, injecthack1778550335, and sampledocpayload624286.
Full reasoning
The sentence mixes up file names with package (gem) names.
The report this post is based on says: “Agents used file names like hack.rb, evil.rb, inject.rb, exploit.rb, and ssrf.rb.” In other words, the report explicitly describes these as filenames, not package names.
Public package diffs confirm that distinction:
- The gem southpxdatapp6pi contains a file named hack.rb.
- The gem lambethcalcqzewgt contains a file named evil.rb.
- The gem injecthack1778550335 contains a file named lib/inject.rb.
- The gem sampledocpayload624286 contains a file named exploit.rb.
So the post is wrong on the specific factual point that these were the package names. They were filenames inside packages whose actual names were different.
5 sources
- OpenAI agents carried out an undisclosed cyber-attack on RubyGems
The report says: “Agents used file names like hack.rb, evil.rb, inject.rb, exploit.rb, and ssrf.rb.”
- RubyGems - southpxdatapp6pi - Versions diffs - 0.0.1 - Mend - Supply Chain Defender
The package name is southpxdatapp6pi, and its files include hack.rb.
- RubyGems - lambethcalcqzewgt - Versions diffs - 0.0.1 - Mend - Supply Chain Defender
The package name is lambethcalcqzewgt, and its files include evil.rb.
- RubyGems - injecthack1778550335 - Versions diffs - 0.0.1 - Mend - Supply Chain Defender
The package name is injecthack1778550335, and its files include lib/inject.rb.
- RubyGems - sampledocpayload624286 - Versions diffs - 0.0.6 - Mend - Supply Chain Defender
The package name is sampledocpayload624286, and its files include exploit.rb.