News for hackers. Stuff that matters.

A comment on Supply-chain attack hits RubyGems repository with malicious packages.

Re:Supply-chain attack hits RubyGems repository with malicio... by thanksforfish on Saturday April 18, 2020 @11:37AM (#22908435)
> this malicious gem had 2,100 downloads, close to 30% of the total downloads that the legitimate gem

I wonder if most of those downloads are fake to boost the download stats and to give more credibility. Either way, that's troubling...

[ Parent | on HN ]
Re:Supply-chain attack hits RubyGems repository with malicio... by tinco on Saturday April 18, 2020 @01:07PM (#22909131)
I've published a couple gems that I'm pretty sure no one uses, and after a few months the downloads was in the hundreds, probably bots and mirrors. Most likely the figure only makes when seen relative to other gems.
[ Parent | on HN ]