Gem install: What could go wrong?
summary
Supply-chain attacks are rising — Sonatype shows a 650% increase in 2021 (430% in 2020) — and real incidents include Codecov exfiltration, typo‑/combo‑squatting gems like pretty_color and ruby‑bitcoin, account takeovers that pushed malicious releases (rest-client, strong_password, bootstrap_sass), and dependency confusion. Concrete mitigations are proven: a GitHub‑action allowlist prototype, Bundler fixes (upgrade to Bundler >= 2.2.2 to pin sources), gem signing, and account hygiene like MFA enforced and an MFA for top 100 gems policy in progress.
AI-written summary · about
chapters (12)
- 0:00Welcome
- 4:15Gem security matters
- 8:50Worst-case scenarios
- 14:09Typo squatting explained
- 16:15Dependency confusion attacks
- 17:37Account takeovers
- 18:21Repository compromise
- 20:26Countermeasures
- 21:49Fixing dependency confusion
- 23:37Mitigating repository compromise
- 24:41Preventing account takeovers
- 28:15Enabling MFA
related talks
36mSecurity is hard, but we can't go shopping
31mA survey of recent RubyGems CVEs
42mHacking With Gems
40mSecurity Is Hard, But We Can't Go Shopping
35mMaking it on your own and the pitfalls of gem dependencies
29mRubyGems.org MFA: The Past, Present and Future
15m“Security” in the JavaScript ecosystem
25mWhen the supply chain hits a sour note