---
id: 1439
title: "Auditing the Ruby ecosystem's central package repository"
source_domain: blog.trailofbits.com
source_url: "https://blog.trailofbits.com/2024/12/11/auditing-the-ruby-ecosystems-central-package-repository/"
published_at: "2024-12-11 14:00"
tags: ["supply-chain", "ruby", "open-source", "rubygems", "security-audit", "trail-of-bits", "package-manager"]
phying_url: "https://phying.com/item/1439"
lang: en
---

# Auditing the Ruby ecosystem's central package repository

## Summary

Trail of Bits audited RubyGems.org for Ruby Central over five engineer-weeks, finding 33 issues including a high-severity StartTLS flaw and missing multi-party approval for production deployments.

## Intelligence Metadata

- **Sources:** blog.trailofbits.com
- **Published:** 2024-12-11 14:00
- **Original:** https://blog.trailofbits.com/2024/12/11/auditing-the-ruby-ecosystems-central-package-repository/
- **Phying News:** https://phying.com/item/1439