Which versions of kaleido are malicious?

The following RubyGems versions of kaleido are flagged malicious: 5000.1.0. Treat any of these as compromised.

How do I remediate kaleido if I installed it?

Remove kaleido from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed kaleido — how do I know if it already compromised me?

If kaleido was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is kaleido part of a known attack campaign?

Yes — kaleido is associated with the RLMA-2026-00953, RLUA-2026-08242 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find kaleido across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for kaleido (version 5000.1.0).

Malicious package

kaleidoRubyGems

Advisory published Mar 18, 2026Updated Sep 24, 2026

kaleido is a confirmed malicious RubyGems package (MAL-2026-1917) that executes malicious code on install (malicious version 5000.1.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in kaleido (RubyGems)

MAL-2026-1917

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall kaleido

Malicious versions

1 flagged

5000.1.0

Indicators of compromise (SHA-256)

c5a35982674c4ac052a089e4a6fd7639afab8859db1600c0c0e2010fac5173b0

6b0a1a9da53af6dc0b56e03e2ae6418c2b4d2937a75ad23fad8193c6dde80303

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for kaleido (version 5000.1.0).
If you installed it — respond
Remove kaleido from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If kaleido was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. kaleido on RubyGems has been identified as a malicious package (version 5000.1.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-00953RLUA-2026-08242

References

github.com

Credits

ReversingLabs · finder

Detect & block this

O3 blocks kaleido-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database