Which versions of bundllef are malicious?

The following RubyGems versions of bundllef are flagged malicious: 1.0.0, 1.0.18131. Treat any of these as compromised.

How do I remediate bundllef if I installed it?

Remove bundllef from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed bundllef — how do I know if it already compromised me?

If bundllef was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is bundllef part of a known attack campaign?

Yes — bundllef is associated with the RLMA-2026-07672 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find bundllef across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for bundllef (2 malicious versions).

Malicious package

bundllefRubyGems

Advisory published Sep 22, 2026Updated Sep 24, 2026

bundllef is a confirmed malicious RubyGems package (MAL-2026-16986) that executes malicious code on install (malicious versions 1.0.0, 1.0.18131). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in bundllef (RubyGems)

MAL-2026-16986

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall bundllef

Malicious versions

2 flagged

1.0.01.0.18131

Indicators of compromise (SHA-256)

6d956b3cc1eac5e6c09b9d84b0fd5893c8e5d9142142d1a005092690864c8621

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for bundllef (2 malicious versions).
If you installed it — respond
Remove bundllef from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If bundllef was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. bundllef on RubyGems has been identified as a malicious package (versions 1.0.0, 1.0.18131 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-07672

Credits

ReversingLabs · finder

Detect & block this

O3 blocks bundllef-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database