CLAIM-2026-09-14-03

Ruby Central states it removed more than 500 malicious packages and that gem installs and pushes for existing users remained unaffected.

Why it matters

Existing users were unaffected, so a dependency-pinning response would have caught nothing. The control that mattered was on the publish path, not the install path.

Sources

• rubygemsblo2026update