Which versions of gitlab-orchestrator are malicious?

The following RubyGems versions of gitlab-orchestrator are flagged malicious: 99.99.9, 99.99.10. Treat any of these as compromised.

How do I remediate gitlab-orchestrator if I installed it?

Remove gitlab-orchestrator from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed gitlab-orchestrator — how do I know if it already compromised me?

If gitlab-orchestrator was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is gitlab-orchestrator part of a known attack campaign?

Yes — gitlab-orchestrator is associated with the RLMA-2026-02087, RLUA-2026-08153 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find gitlab-orchestrator across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for gitlab-orchestrator (2 malicious versions).

Malicious package

gitlab-orchestratorRubyGems

Advisory published Apr 16, 2026Updated Sep 24, 2026

gitlab-orchestrator is a confirmed malicious RubyGems package (MAL-2026-2814) that executes malicious code on install (malicious versions 99.99.9, 99.99.10). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in gitlab-orchestrator (RubyGems)

MAL-2026-2814

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall gitlab-orchestrator

Malicious versions

2 flagged

99.99.999.99.10

Indicators of compromise (SHA-256)

3c96ab97f2bf4036a13cdd307c4f2fbbc33dcd93782d80ac455a3dde22668caa

c50e5cda34541ef48a949d062836863b417fbfc9d3291a4a954a266c7009bbb4

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for gitlab-orchestrator (2 malicious versions).
If you installed it — respond
Remove gitlab-orchestrator from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If gitlab-orchestrator was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. gitlab-orchestrator on RubyGems has been identified as a malicious package (versions 99.99.9, 99.99.10 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-02087RLUA-2026-08153

References

github.com

Credits

ReversingLabs · finder

Detect & block this

O3 blocks gitlab-orchestrator-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database