Malicious gem version spotted

[marysieek]

My name is Maria, and I am a Development Team Leader at Mend Supply Chain Defender (mend.io).

I am contacting you because we noticed two versions of activejob-limiter gem perform HTTP calls to an external domain. The activity suggests a name takeover. We think it happened because a reference to RubyGems exists in the Readme.md file, but the gem name was not occupied. Malicious actors scan Github code for such indications and then take over those names for research/malicious purposes.

The attacker published two malicious versions of the gem:

https://my.diffend.io/gems/activejob-limiter/5.0.1
https://my.diffend.io/gems/activejob-limiter/5.0.1/6.0.1

We have already contacted RubyGems, and the gem has already been removed.