Which versions of lbcaltestipnern are malicious?

The following RubyGems versions of lbcaltestipnern are flagged malicious: 0.0.1. Treat any of these as compromised.

How do I remediate lbcaltestipnern if I installed it?

Remove lbcaltestipnern from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed lbcaltestipnern — how do I know if it already compromised me?

If lbcaltestipnern was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is lbcaltestipnern part of a known attack campaign?

Yes — lbcaltestipnern is associated with the RLMA-2026-02558, RLUA-2026-08375 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find lbcaltestipnern across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for lbcaltestipnern (version 0.0.1).

Malicious package

lbcaltestipnernRubyGems

Advisory published Jul 7, 2026Updated Sep 24, 2026

lbcaltestipnern is a confirmed malicious RubyGems package (MAL-2026-7907) that executes malicious code on install (malicious version 0.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in lbcaltestipnern (RubyGems)

MAL-2026-7907

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall lbcaltestipnern

Malicious versions

1 flagged

0.0.1

Indicators of compromise (SHA-256)

412fdd97271122899bf07a55d743321a50ff2f03d34681569b25de6360cd9ece

263851a7785b72e61f03e016577db2c7b8918c5370dc42f9b37fc39a8cab679f

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for lbcaltestipnern (version 0.0.1).
If you installed it — respond
Remove lbcaltestipnern from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If lbcaltestipnern was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. lbcaltestipnern on RubyGems has been identified as a malicious package (version 0.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-02558RLUA-2026-08375

References

github.com

Credits

ReversingLabs · finder

Detect & block this

O3 blocks lbcaltestipnern-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database