Typosquatted Ruby Gem Nearly Merged, Exposing Gaps in Supply Chain Security

A developer team narrowly avoided installing a malicious Ruby gem after a reviewer spotted a one-character typo in its name during a pull request — a catch attributed to luck rather than any formal process. The gem's extconf.rb file was designed to execute arbitrary code at install time, meaning damage could occur on developer machines or CI runners before the package ever reached production. The incident highlighted over-reliance on RubyGems.org's automated defenses, which the registry itself estimates catch only 70–80% of malicious packages, leaving a significant residual risk. Security experts recommend a layered defense approach including pinning and committing Gemfile.lock, avoiding floating version ranges, and enabling Bundler 2.6's checksum verification to detect tampered packages. The case underscores that supply chain threats such as typosquatting, lockfile injection, and post-disclosure vulnerabilities are routine background noise in modern software development, not rare edge cases.