BLOG ## Malicious Crypto Shell Packages Target RubyGems A threat actor calling themselves "Ghost Dev" published 42 malicious typo squat packages to the RubyGems registry targeting crypto and web3 packages By c0a15726-c5b1-4b0d-85e6-fe15553df9e2 · 2026-10-05T10:59:28.013Z The OpenSourceMalware automatic detection engine has identified 40+ malicious packages that use typosquatting, brandjacking, and plausible utility names to target crypto and web3 developers. There are two variants, either installing a reverse-shell or a cryptostealer. Initially, we analyzed a malicious RubyGems package that…