Which versions of lpp09927 are malicious?

The following RubyGems versions of lpp09927 are flagged malicious: 0.0.69927. Treat any of these as compromised.

How do I remediate lpp09927 if I installed it?

Remove lpp09927 from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed lpp09927 — how do I know if it already compromised me?

If lpp09927 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is lpp09927 part of a known attack campaign?

Yes — lpp09927 is associated with the RLMA-2026-02700, RLUA-2026-08548 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find lpp09927 across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for lpp09927 (version 0.0.69927).

Malicious package

lpp09927RubyGems

Advisory published Jul 7, 2026Updated Sep 24, 2026

lpp09927 is a confirmed malicious RubyGems package (MAL-2026-8049) that executes malicious code on install (malicious version 0.0.69927). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in lpp09927 (RubyGems)

MAL-2026-8049

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall lpp09927

Malicious versions

1 flagged

0.0.69927

Indicators of compromise (SHA-256)

a1a5767512f6b61de35c31336c0fb18221c56bf1efbe9e56bace31ccd34ab3f9

ed83b54e728c35821531aa59f8877b6772ac180f7a0ba2702fa68d1fd4a092a1

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for lpp09927 (version 0.0.69927).
If you installed it — respond
Remove lpp09927 from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If lpp09927 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. lpp09927 on RubyGems has been identified as a malicious package (version 0.0.69927 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-02700RLUA-2026-08548

References

github.com

Credits

ReversingLabs · finder

Detect & block this

O3 blocks lpp09927-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database