Patching fast and slow: Ruby devs delay to defend against supply chain attack (opens in new tab)

The team behind RubyGems, a package hosting site for Ruby developers, has added a new feature to bundler, a tool for managing Ruby packages (or ‘gems’) to protect developers against the recent wave of : A cooling-off period before recently updated packages are installed on their systems. Recent have focused on stealing developer credentials in order to introduce malicious code into the packages they create, which then steals more developers’ credentials when they install the malicious updates...