Which versions of galvinhsiu-active-cart are malicious?

The following RubyGems versions of galvinhsiu-active-cart are flagged malicious: 0.0.20. Treat any of these as compromised.

How do I remediate galvinhsiu-active-cart if I installed it?

Remove galvinhsiu-active-cart from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed galvinhsiu-active-cart — how do I know if it already compromised me?

If galvinhsiu-active-cart was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is galvinhsiu-active-cart part of a known attack campaign?

Yes — galvinhsiu-active-cart is associated with the RLMA-2024-05732, RLUA-2024-10251, RLUA-2026-08138 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find galvinhsiu-active-cart across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for galvinhsiu-active-cart (version 0.0.20).

Malicious package

galvinhsiu-active-cartRubyGems

Advisory published Jun 25, 2024Updated Sep 24, 2026

galvinhsiu-active-cart is a confirmed malicious RubyGems package (MAL-2024-6926) that executes malicious code on install (malicious version 0.0.20). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in galvinhsiu-active-cart (RubyGems)

MAL-2024-6926

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall galvinhsiu-active-cart

Malicious versions

1 flagged

0.0.20

Indicators of compromise (SHA-256)

9e1b781c62dbbf0a4787fe6ac0de2fca0c5a0aace4b12a1ee803273de9af9c64

d8bd64e6697afd10ff8b2431db5ac363a613dc0c6061e848f9251385bc58aa11

b0d0acf6da98326cb36e73e1cd859d4721b7346e994ea019541183ec55c4cfd4

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for galvinhsiu-active-cart (version 0.0.20).
If you installed it — respond
Remove galvinhsiu-active-cart from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If galvinhsiu-active-cart was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. galvinhsiu-active-cart on RubyGems has been identified as a malicious package (version 0.0.20 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2024-05732RLUA-2024-10251RLUA-2026-08138

References

Credits

ReversingLabs · finder

Detect & block this

O3 blocks galvinhsiu-active-cart-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database