Malicious versions of the popular rest-client gem were published after a credential compromise, adding a remote code-execution backdoor and credential exfiltration.
rest-client had tens of millions of downloads; the backdoor phoned home to a pastebin-hosted payload.
A legitimate package's maintainer account or pipeline was taken over and a malicious version published.
Attacks like this are why dependency provenance matters. Scan your manifests against the Gold database; a free CI gate that blocks risky dependencies before they merge is coming soon.