Which versions of budnlef are malicious?

The following RubyGems versions of budnlef are flagged malicious: 1.0.0, 1.0.43999. Treat any of these as compromised.

How do I remediate budnlef if I installed it?

Remove budnlef from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed budnlef — how do I know if it already compromised me?

If budnlef was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is budnlef part of a known attack campaign?

Yes — budnlef is associated with the RLMA-2026-07465 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find budnlef across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for budnlef (2 malicious versions).

Malicious package

budnlefRubyGems

Advisory published Sep 22, 2026Updated Sep 24, 2026

budnlef is a confirmed malicious RubyGems package (MAL-2026-16780) that executes malicious code on install (malicious versions 1.0.0, 1.0.43999). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in budnlef (RubyGems)

MAL-2026-16780

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall budnlef

Malicious versions

2 flagged

1.0.01.0.43999

Indicators of compromise (SHA-256)

19d40a860f14a0196af60d2658c0b4fd0e351459fb4706e464135d7d9f84a508

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for budnlef (2 malicious versions).
If you installed it — respond
Remove budnlef from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If budnlef was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. budnlef on RubyGems has been identified as a malicious package (versions 1.0.0, 1.0.43999 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-07465

Credits

ReversingLabs · finder

Detect & block this

O3 blocks budnlef-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database