Which versions of lai67121802 are malicious?

The following RubyGems versions of lai67121802 are flagged malicious: 0.0.70802. Treat any of these as compromised.

How do I remediate lai67121802 if I installed it?

Remove lai67121802 from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed lai67121802 — how do I know if it already compromised me?

If lai67121802 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is lai67121802 part of a known attack campaign?

Yes — lai67121802 is associated with the RLMA-2026-02433, RLUA-2026-08248 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find lai67121802 across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for lai67121802 (version 0.0.70802).

Malicious package

lai67121802RubyGems

Advisory published Jul 7, 2026Updated Sep 24, 2026

lai67121802 is a confirmed malicious RubyGems package (MAL-2026-7782) that executes malicious code on install (malicious version 0.0.70802). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in lai67121802 (RubyGems)

MAL-2026-7782

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall lai67121802

Malicious versions

1 flagged

0.0.70802

Indicators of compromise (SHA-256)

b895c38e11b9b82f478c1c9e6392c3d10e904448dca95bf67571ff7f60621f64

9e576367dd83e80d20a8cd015c40a94a6fa9b38a1384c741f50b4e5c836a8b75

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for lai67121802 (version 0.0.70802).
If you installed it — respond
Remove lai67121802 from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If lai67121802 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. lai67121802 on RubyGems has been identified as a malicious package (version 0.0.70802 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-02433RLUA-2026-08248

References

github.com

Credits

ReversingLabs · finder

Detect & block this

O3 blocks lai67121802-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database