Which versions of lbcaltestcwukld are malicious?

The following RubyGems versions of lbcaltestcwukld are flagged malicious: 0.0.1. Treat any of these as compromised.

How do I remediate lbcaltestcwukld if I installed it?

Remove lbcaltestcwukld from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed lbcaltestcwukld — how do I know if it already compromised me?

If lbcaltestcwukld was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is lbcaltestcwukld part of a known attack campaign?

Yes — lbcaltestcwukld is associated with the RLMA-2026-02556, RLUA-2026-08373 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find lbcaltestcwukld across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for lbcaltestcwukld (version 0.0.1).

Malicious package

lbcaltestcwukldRubyGems

Advisory published Jul 7, 2026Updated Sep 24, 2026

lbcaltestcwukld is a confirmed malicious RubyGems package (MAL-2026-7905) that executes malicious code on install (malicious version 0.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in lbcaltestcwukld (RubyGems)

MAL-2026-7905

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall lbcaltestcwukld

Malicious versions

1 flagged

0.0.1

Indicators of compromise (SHA-256)

e45d4bc914a31af30d6bf15c0ba62b827651b51695a0a926341772c72a1534f2

d944444df68c2b3b7141880146ecf7ad44f41066048b3a56753b04b7d83b944b

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for lbcaltestcwukld (version 0.0.1).
If you installed it — respond
Remove lbcaltestcwukld from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If lbcaltestcwukld was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. lbcaltestcwukld on RubyGems has been identified as a malicious package (version 0.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-02556RLUA-2026-08373

References

github.com

Credits

ReversingLabs · finder

Detect & block this

O3 blocks lbcaltestcwukld-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database