Which versions of html_scrubber are malicious?

The following RubyGems versions of html_scrubber are flagged malicious: 90002.0. Treat any of these as compromised.

How do I remediate html_scrubber if I installed it?

Remove html_scrubber from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed html_scrubber — how do I know if it already compromised me?

If html_scrubber was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is html_scrubber part of a known attack campaign?

Yes — html_scrubber is associated with the RLMA-2025-06616, RLUA-2026-08219 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find html_scrubber across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for html_scrubber (version 90002.0).

Malicious package

html_scrubberRubyGems

Advisory published Dec 23, 2025Updated Sep 24, 2026

html_scrubber is a confirmed malicious RubyGems package (MAL-2025-192909) that executes malicious code on install (malicious version 90002.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in html_scrubber (RubyGems)

MAL-2025-192909

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall html_scrubber

Malicious versions

1 flagged

90002.0

Indicators of compromise (SHA-256)

0d3dbba9053b832157a51cdb3d383c4d8a084a6461e2da023e0e0def18b8dd4e

1c30392839ce499de5828d3ed5daf4c2d25e347bc02253ec1b2dc1365bbe5c2b

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for html_scrubber (version 90002.0).
If you installed it — respond
Remove html_scrubber from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If html_scrubber was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. html_scrubber on RubyGems has been identified as a malicious package (version 90002.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2025-06616RLUA-2026-08219

References

github.com

Credits

ReversingLabs · finder

Detect & block this

O3 blocks html_scrubber-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database