Malicious versions of the popular rest-client gem were published after a credential compromise, adding a remote code-execution backdoor and credential exfiltration.
rest-client had tens of millions of downloads; the backdoor phoned home to a pastebin-hosted payload.
A legitimate package's maintainer account or pipeline was taken over and a malicious version published.
Attacks like this are why dependency provenance matters. Scan your manifests against the Gold database, or add the free CI gate to block risky dependencies before they merge.