Ruby Fights Supply-Chain Attacks With Filter Offering 'Cooldown' Before Installing New Packages
SUMMARYRuby’s Bundler now includes an optional “cooldown” filter that blocks newly published package versions until they have aged for a set number of days, reducing the chance of installing malicious releases in a supply-chain attack window. The change complements existing protections on rubygems.org, including mandatory 2FA, trusted publishing, push-time content validation, password checks against Have I Been Pwned, and AI-assisted vulnerability scanning for critical gems.
Most supply-chain attacks using Ruby's package hosting site "exploit a narrow window," according to a new blog post form Ruby core maintainer Hiroshi Shibata.
So its packaging-managing Bundler tool now offers a filter that blocks new version until it's been public "for at least N days. Releases too new to have been scrutinized are passed over in favor of ones that have aged past the window."
The feature was designed in the open, drawing on how other ecosystems approach the same problem. It is opt-in, and complements rather than replaces existing defenses like mandatory 2FA and trusted publishing... Cooldown is unset by default, so a project without it keeps resolving to the newest versions.... Passing 0 disables cooldown for the run...
Cooldown is most useful as one part of the wider security investment happening on rubygems.org. The registry now validates gem contents at push time and checks logins against Have I Been Pwned so that compromised passwords cannot be reused, work described in Protecting rubygems.org from the outside in. A dedicated team is running AI-assisted vulnerability scanning against the most critical gems, backed by Alpha Omega and Anthropic, and the direction of all of this is tracked on a public roadmap. Trusted publishing and mandatory 2FA already raise the bar for who can push a release in the first place.