Which versions of dradis_nmap are malicious?

The following RubyGems versions of dradis_nmap are flagged malicious: 3.15.0. Treat any of these as compromised.

How do I remediate dradis_nmap if I installed it?

Remove dradis_nmap from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed dradis_nmap — how do I know if it already compromised me?

If dradis_nmap was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is dradis_nmap part of a known attack campaign?

Yes — dradis_nmap is associated with the RLMA-2024-05678, RLUA-2024-10197, RLUA-2026-08016 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find dradis_nmap across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for dradis_nmap (version 3.15.0).

Malicious package

dradis_nmapRubyGems

Advisory published Jun 25, 2024Updated Sep 24, 2026

dradis_nmap is a confirmed malicious RubyGems package (MAL-2024-6872) that executes malicious code on install (malicious version 3.15.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in dradis_nmap (RubyGems)

MAL-2024-6872

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall dradis_nmap

Malicious versions

1 flagged

3.15.0

Indicators of compromise (SHA-256)

1f6791156ed0fb79a3a0c8e78de74478cf5b02fd3728c28a09530713f00d148c

6bbdabce4efbbfb5ac7c5d8f72490bb786355793c1e2feae094d51f548483720

9de370c8f3df2a6d69b756a87971de8e0f0cd84f6b2cd61283978999395917c2

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for dradis_nmap (version 3.15.0).
If you installed it — respond
Remove dradis_nmap from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If dradis_nmap was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. dradis_nmap on RubyGems has been identified as a malicious package (version 3.15.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2024-05678RLUA-2024-10197RLUA-2026-08016

References

Credits

ReversingLabs · finder

Detect & block this

O3 blocks dradis_nmap-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database