A new wave of malicious packages found across npm, PyPI, and RubyGems has again exposed how vulnerable the open-source software supply chain remains to exploitation.
According to new research from Socket, threat actors are actively publishing clones of legitimate software packages that, once installed, execute harmful payloads ranging from cryptocurrency theft to full codebase deletion.
A closer look: RubyGems, Telegram, and the Vietnam connection
Socket researchers uncovered two nearly identical clones of the popular fastlane-plugin-telegram Ruby gem, which is typically used in CI/CD pipelines to send deployment notifications to Telegram channels. However, these clones reroute all Telegram API traffic to a command-and-control (C2) server operated by the attacker.
“These gems silently exfiltrate all data sent to the Telegram API,” said Socket researcher Kirill Boychenko. “This includes bot tokens, chat IDs, message content, and attached files.”
Interestingly, the malicious packages were uploaded shortly after Vietnam enacted a national ban on Telegram for allegedly failing to cooperate with authorities on illicit activity. The attacker’s aliases used—”Bùi nam,” “buidanhnam,” and “si_mobile”—suggest a possible regional connection, but the malware itself contains no geographic restrictions and poses a global threat.
Why supply chain attacks keep working
Eric Schwake, Director of Cybersecurity Strategy at Salt Security, noted that this incident showcases the deeply embedded risks of API exploitation through compromised open-source packages. “Malicious actors take advantage of the trust inherent in open-source environments by embedding harmful code… capturing bot tokens, chat IDs, and message content,” Schwake said. “This highlights why strong API security and governance are vital for tracking anomalous activity.”
Boris Cipot, Senior Security Engineer at Black Duck, emphasized that attackers continue to rely on tried-and-true methods such as typosquatting, where slight alterations in package names (e.g., “Twiter” instead of “Twitter”) deceive developers into installing malware. He also warned about transitive dependencies: “Malicious actors take over the codebase of an OSS component not directly referenced but buried in the dependency tree. These changes are hard to spot, yet they still spread malicious content effectively.”
Jason Soroko, Senior Fellow at Sectigo, added that developer behavior plays a role in these compromises: “Every mobile app, website, and enterprise system you touch is likely built from dozens of open-source packages. A single line swap can reroute every API call through attacker infrastructure. Developers use these without thinking—and attackers know it.”
Mitigation strategies: from awareness to automation
To protect against these kinds of supply chain attacks, security experts recommend:
-
Pinning versions in manifest lockfiles
-
Using checksums and vendor hashes to confirm integrity
-
Scanning builds with tools like Socket, OSV-Scanner, Syft, and Grype
-
Sandboxing CI secrets so tokens never leave the build environment
-
Mirroring trusted registries internally and curating allowed packages
-
Monitoring runtime behavior for suspicious egress traffic
“Security teams can still ship code without abandoning public repositories,” said Soroko. “But they must treat third-party code as untrusted until proven otherwise.”
Follow SecureWorld News for more stories related to cybersecurity.