RubyGems install-time code execution: four data-exfiltrating gems run code on gem install and even gem list
Severity: medium · Patch status: partial · Since 2026-11-05
Aikido researchers found that Ruby gems can execute attacker code during install via native extension Rakefiles, and RubyGems plugins run on every gem command including gem list and gem -v. New detection rules surfaced four data-exfiltrating gems on RubyGems (published 2013–2015) that send the installer's username, a macOS screenshot, or a beacon to a remote server; they remained installable as of Nov 4, 2026. Unlike npm 12, which made install scripts opt-in, stable RubyGems/Bundler 4.0.x offers no way to disable extension builds or plugin installs; the 4.1.0.beta3 prerelease adds opt-out flags (off by default). The extension and plugin execution paths and the four gems were reported to the RubyGems security team in October 2026. Anyone running gem install or bundle install on laptops or CI is affected; installing a malicious gem alone triggers the payload.
What to do
- Search lockfiles and installed gems for xmastree, ancient-city-ruby, hacky, et_phone_home (repeat per Ruby version); if found, stop spawned processes, gem uninstall --all --executables, remove from Gemfile, and assess exfiltration exposure
- List RubyGems plugin directories (ruby -e 'Gem.path.each { |p| puts Gem.plugindir(p) }') and uninstall unneeded plugins
- Upgrade to RubyGems/Bundler 4.1.0.beta3 and disable install-time execution: --no-build-extension --no-install-plugin for gem install; bundle config set --global no_build_extension true and no_install_plugin true; set BUNDLE_NO_BUILD_EXTENSION=true and BUNDLE_NO_INSTALL_PLUGIN=true in CI
- Note that skipped-extension gems won't load (bundle exec fails); only disable extension builds in install-only CI steps unless all gems have precompiled builds
Fixed versions
- RubyGems/Bundler 4.1.0.beta3 (opt-out settings)
Sources
All live incidents on Threat Watch
