Windows Infostealer Hits npm and Ruby

A single threat actor ran parallel typosquatting campaigns on npm (37 packages) and RubyGems (16 packages) delivering an identical Rust loader and embedded Go infostealer that decrypts in memory; the operation exfiltrates browser credentials, wallets, Telegram data and host information to Gofile and reports to a webhook at dresslee.com, with confirmed network and file IOCs (IP 193.70.34.101:20099, GitHub release URL, and matching SHA-256 hashes).