Which versions of commonmarker_pluggable are malicious?

The following RubyGems versions of commonmarker_pluggable are flagged malicious: 0.3.0. Treat any of these as compromised.

How do I remediate commonmarker_pluggable if I installed it?

Remove commonmarker_pluggable from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed commonmarker_pluggable — how do I know if it already compromised me?

If commonmarker_pluggable was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is commonmarker_pluggable part of a known attack campaign?

Yes — commonmarker_pluggable is associated with the RLMA-2024-05647, RLUA-2024-10166, RLUA-2026-07942 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find commonmarker_pluggable across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for commonmarker_pluggable (version 0.3.0).

Malicious package

commonmarker_pluggableRubyGems

Advisory published Jun 25, 2024Updated Sep 24, 2026

commonmarker_pluggable is a confirmed malicious RubyGems package (MAL-2024-6841) that executes malicious code on install (malicious version 0.3.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in commonmarker_pluggable (RubyGems)

MAL-2024-6841

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall commonmarker_pluggable

Malicious versions

1 flagged

0.3.0

Indicators of compromise (SHA-256)

fed2aba176c1fcf665ea0885028c67ddd23bbfff9cc91706284cfc0ab66704ce

2add5abe486cb4ab10bb3215216a12089c90234a4d735db42e2c13fd4f7a9b90

e12a219ebcf6a5ff0c87b595a206f9f8ea47ef8011cae213f0082874a63618ff

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for commonmarker_pluggable (version 0.3.0).
If you installed it — respond
Remove commonmarker_pluggable from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If commonmarker_pluggable was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. commonmarker_pluggable on RubyGems has been identified as a malicious package (version 0.3.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2024-05647RLUA-2024-10166RLUA-2026-07942

References

Credits

ReversingLabs · finder

Detect & block this

O3 blocks commonmarker_pluggable-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database