GemStuffer: Attackers Weaponize RubyGems as a Covert Data Drop for UK Gov Scraping

Socket’s research uncovered “GemStuffer,” a campaign that systematically scrapes council ModernGov portals (examples: Lambeth, Wandsworth, Southwark) and exfiltrates the collected pages by embedding HTTP responses into .gem packages pushed to RubyGems. The actors use Ruby-specific techniques (overriding HOME to a /tmp gem home, strict credential permissions, manual API POSTs, and binary writes to avoid encoding errors) to blend with normal package publishing; mitigations include yanking malicious gems, auditing /tmp gem homes, monitoring ENV['HOME'] mutations, and restricting outbound pushes to rubygems.org.