MALICIOUS RUBYGEMS POSE AS FASTLANE TO STEAL TELEGRAM API DATA

Summary from the TLDR InfoSec newsletter

Researchers at Socket identified two malicious Ruby gems impersonating the fastlane-plugin-telegram gem, which is used for sending CI/CD updates from Fastlane to a Telegram channel. The typosquatted gems are nearly identical to the legitimate gem except that they redirect Telegram API calls to an attacker-controlled server. Any bot tokens that were used in builds with the malicious gems should be considered compromised.