Which versions of codestats_metrics-reporter are malicious?

The following RubyGems versions of codestats_metrics-reporter are flagged malicious: 0.1.13. Treat any of these as compromised.

How do I remediate codestats_metrics-reporter if I installed it?

Remove codestats_metrics-reporter from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed codestats_metrics-reporter — how do I know if it already compromised me?

If codestats_metrics-reporter was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is codestats_metrics-reporter part of a known attack campaign?

Yes — codestats_metrics-reporter is associated with the RLMA-2024-05642, RLUA-2024-10161, RLUA-2026-07937 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find codestats_metrics-reporter across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for codestats_metrics-reporter (version 0.1.13).

Malicious package

codestats_metrics-reporterRubyGems

Advisory published Jun 25, 2024Updated Sep 24, 2026

codestats_metrics-reporter is a confirmed malicious RubyGems package (MAL-2024-6836) that executes malicious code on install (malicious version 0.1.13). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in codestats_metrics-reporter (RubyGems)

MAL-2024-6836

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall codestats_metrics-reporter

Malicious versions

1 flagged

0.1.13

Indicators of compromise (SHA-256)

51e65ebef2b779a7a88f980347161bb85e088568a952701f90c04717f40ecf0e

6ed11dd358e50389ec3c32f6d6f9a36999c081d043360c91bf60a8ff2a9610a0

db08ecb2461e07448c5f3b125ed13e67e164ed1f5dc9f31f878e349b459bbc94

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for codestats_metrics-reporter (version 0.1.13).
If you installed it — respond
Remove codestats_metrics-reporter from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If codestats_metrics-reporter was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. codestats_metrics-reporter on RubyGems has been identified as a malicious package (version 0.1.13 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2024-05642RLUA-2024-10161RLUA-2026-07937

References

Credits

ReversingLabs · finder

Detect & block this

O3 blocks codestats_metrics-reporter-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database