PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Auditing the Ruby ecosystem's central package repository

blog.trailofbits.com | blog | #supply-chain | #ruby | #open-source | #rubygems | #security-audit | #trail-of-bits | #package-manager
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Trail of Bits audited RubyGems.org for Ruby Central over five engineer-weeks, finding 33 issues including a high-severity StartTLS flaw and missing multi-party approval for production deployments.
Published
Collected

Related coverage

blog · blog.trailofbits.com
Package managers have an integrity problem
# Package managers have an integrity problem Keegan Ryan October 14, 2026 supply-chain, cryptography, ecosystem-security Page content * Simulating malicious package repositories * HTTPS is...
blog · blog.trailofbits.com
1Password's AI patching benchmark is misleading
Trail of Bits says 1Password's FLAWED benchmark misstates AI patch quality, mixing wrong-fix prompts and no-test trials into a 26% clean-fix headline, and ships two agent skills for better fixes.
incident · aikido.dev
SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts
It's not often we see a supply chain attack on RubyGems. But with summer vacations in full swing, perhaps we should have expected one. It was still a surprise when I opened the triage queue this morning and found a suspicious new package waiting.
blog · blog.trailofbits.com
Your AI agent fixed the bug, but what else did it change?
We’re publishing patching-bugs and regression-hunt, two plugins that let engineers delegate patch development and regression checks to agents.
blog · blog.trailofbits.com
SequenceHash: multihashing for the rest of us
We're releasing SequenceHash and its sister function SequenceMAC, a pair of related hash constructions that bring secure multihashing to developers using hash functions other than Keccak.
blog · blog.trailofbits.com
Auditing in the age of (good enough) AI
Trail of Bits explains how agents built tooling and a Lean model for the Miden zkVM audit, finding a flaw enabling Falcon signature forgery and yielding 95 machine-checked proofs.
Back