Which versions of hola_rreichel3github are malicious?

The following RubyGems versions of hola_rreichel3github are flagged malicious: 0.0.10. Treat any of these as compromised.

How do I remediate hola_rreichel3github if I installed it?

Remove hola_rreichel3github from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed hola_rreichel3github — how do I know if it already compromised me?

If hola_rreichel3github was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is hola_rreichel3github part of a known attack campaign?

Yes — hola_rreichel3github is associated with the RLMA-2025-06615, RLUA-2026-08208 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find hola_rreichel3github across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for hola_rreichel3github (version 0.0.10).

Malicious package

hola_rreichel3githubRubyGems

Advisory published Dec 23, 2025Updated Sep 24, 2026

hola_rreichel3github is a confirmed malicious RubyGems package (MAL-2025-192908) that executes malicious code on install (malicious version 0.0.10). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in hola_rreichel3github (RubyGems)

MAL-2025-192908

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall hola_rreichel3github

Malicious versions

1 flagged

0.0.10

Indicators of compromise (SHA-256)

95c631ed2a21d0972f544177dacfbc7b22b6e13dffd5ddad58f61a72acc4888b

c95f0b1acb5f762db1cc1930710bed1227fccf5fc7118c0519b86d6bd447e675

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for hola_rreichel3github (version 0.0.10).
If you installed it — respond
Remove hola_rreichel3github from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If hola_rreichel3github was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. hola_rreichel3github on RubyGems has been identified as a malicious package (version 0.0.10 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2025-06615RLUA-2026-08208

References

github.com

Credits

ReversingLabs · finder

Detect & block this

O3 blocks hola_rreichel3github-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database