GCVE-110-OSM-2026-10564

This package is part of a coordinated attack on the Rubygems registry that includes at least 16 malicious packages published across 3 different Rubygems accounts. This campaign delivers a fairly sophisticated and novel Windows-based malware that involves a 22 MB Rust loader, followed by a Golang binary. This is a multistage kill chain with IPs and multiple C2 domains. Like many of the software supply chain malware attacks we are seeing, this one is both an infostealer and cryptostealer. Additionally, this malware appears to target the Brew ecosystem via the lib/install_core/runner.rb file. ADDITIONAL FINDINGS - Homebrew Ruby Process Spawning in lib/ri18nr/compat.rb: "Process.spawn" PAYLOAD FILES lib/ri18nr/compat.rb