bootstrap-sass gem enabled remote execution

The bootstrap-sass compromise used the real RubyGems package name. On March 26, 2019, version 3.2.0.3 appeared on RubyGems without a matching GitHub release or changelog trail. The previous 3.2.0.2 release was also removed.

A user noticed the mismatch, diffed the gem, and found a production-only Rails backdoor. The payload hooked Rack::Sendfile, read a ___cfduid cookie, Base64-decoded its value, and passed the result to eval.

That made any affected Rails production app an execution surface if it accepted a crafted request. The attacker did not need a new application bug. The dependency supplied the bug, loaded inside normal Rails middleware.

Maintainers confirmed the malicious code, removed 3.2.0.3, reset credentials, and later published 3.2.0.4 as the clean replacement for the 3.2 line. The event showed how a quiet registry-only release can outrun source repository review.