Bundler pulled a gem that didn't exist on rubygems.org — but somehow installed

The Suggestion

Claude recommended active_record-fast-query for query caching. The name sounded so Rails-y I didn't question it.

The Odd Part

gem 'active_record-fast-query' resolved. But the rubygems.org page showed 0 downloads. The gem had been yanked and republished with a malicious payload.

Saved By

I happened to read the release notes of a security newsletter that morning warning about exactly this pattern. I froze the install.

Lesson

Typosquats don't just target misspellings — they target plausibility. active_record-fast-query isn't a typo of anything. It's a vibe-squat.