Cybersecurity experts have uncovered a malicious RubyGems package impersonating the trusted Fastlane tool to steal Telegram API credentials. Exemplifying the growing sophistication of supply chain attacks in software development. Such malicious packages, often disguised to appear legitimate, are increasingly used across npm, Python, and Ruby repositories to exfiltrate sensitive data like hijack cryptocurrency wallets or even delete codebases post-installation. Attackers leverage tactics like typosquatting, malware embedding, exploiting emerging technologies and geopolitical tensions to evade detection. Concurrently, threat actors are deploying open-source remote access Trojans like Chaos RAT, crafted in Golang, to gain persistent control over Windows and Linux systems. These tools, resembling legitimate utilities, facilitate expansive control features and are exploited in cryptocurrency mining campaigns. The convergence of sophisticated supply chain infiltration and weaponized open-source malware underscores the urgent need for vigilant package verification and enhanced security practices across development environments. CTIX analysts will continue to report on the latest malware strains and attack methodologies.