Which versions of ebay-enterprise_affiliate_network are malicious?

The following RubyGems versions of ebay-enterprise_affiliate_network are flagged malicious: 1.0.3. Treat any of these as compromised.

How do I remediate ebay-enterprise_affiliate_network if I installed it?

Remove ebay-enterprise_affiliate_network from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed ebay-enterprise_affiliate_network — how do I know if it already compromised me?

If ebay-enterprise_affiliate_network was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is ebay-enterprise_affiliate_network part of a known attack campaign?

Yes — ebay-enterprise_affiliate_network is associated with the RLMA-2024-05686, RLUA-2024-10205, RLUA-2026-08029 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find ebay-enterprise_affiliate_network across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for ebay-enterprise_affiliate_network (version 1.0.3).

Malicious package

ebay-enterprise_affiliate_networkRubyGems

Advisory published Jun 25, 2024Updated Sep 24, 2026

ebay-enterprise_affiliate_network is a confirmed malicious RubyGems package (MAL-2024-6880) that executes malicious code on install (malicious version 1.0.3). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in ebay-enterprise_affiliate_network (RubyGems)

MAL-2024-6880

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall ebay-enterprise_affiliate_network

Malicious versions

1 flagged

1.0.3

Indicators of compromise (SHA-256)

78ba01f1b63472cd50d64f9dbf1341702b82ee8f738db67129b971585f2b5272

6e811e96430f843c53973ea480d2aa927c9cdf0dd93e5600e8df69405662af1e

688de1b05fbe67405a6bf659694465c856ebce58c6c18258a07dc4f6b214966e

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for ebay-enterprise_affiliate_network (version 1.0.3).
If you installed it — respond
Remove ebay-enterprise_affiliate_network from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If ebay-enterprise_affiliate_network was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. ebay-enterprise_affiliate_network on RubyGems has been identified as a malicious package (version 1.0.3 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2024-05686RLUA-2024-10205RLUA-2026-08029

References

Credits

ReversingLabs · finder

Detect & block this

O3 blocks ebay-enterprise_affiliate_network-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database