Threat actors published hundreds of malicious Ruby software packages designed to scrape publicly accessible UK government servers, using the RubyGems public registry as a covert data-staging channel rather than attacker-owned infrastructure. Any organization whose development teams use Ruby and pull packages from rubygems.org without strict integrity controls may have introduced malicious code into their own software supply chain. The business risk spans unauthorized data collection from government-adjacent systems, potential backdoor implantation in internal applications, and exposure of sensitive information processed by affected Ruby applications.