HOW RUBYGEMS.ORG PROTECTS OUR COMMUNITY'S CRITICAL OSS INFRASTRUCTURE

Summary from the TLDR Web Dev newsletter

RubyGems.org uses a multi-layered security approach including automated detection, risk scoring, and retroactive scanning to proactively identify malicious gems, successfully detecting 70-80% of threats before they're publicly reported. In a recent incident involving credential-stealing gems discovered by Socket.dev, the RubyGems security team had already flagged and removed nearly all malicious packages within days of detection in July.