Which versions of m8320v5tkv are malicious?

The following RubyGems versions of m8320v5tkv are flagged malicious: 0.0.1. Treat any of these as compromised.

How do I remediate m8320v5tkv if I installed it?

Remove m8320v5tkv from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed m8320v5tkv — how do I know if it already compromised me?

If m8320v5tkv was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is m8320v5tkv part of a known attack campaign?

Yes — m8320v5tkv is associated with the RLMA-2026-02716, RLUA-2026-08564 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find m8320v5tkv across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for m8320v5tkv (version 0.0.1).

Malicious package

m8320v5tkvRubyGems

Advisory published Jul 7, 2026Updated Sep 24, 2026

m8320v5tkv is a confirmed malicious RubyGems package (MAL-2026-8065) that executes malicious code on install (malicious version 0.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in m8320v5tkv (RubyGems)

MAL-2026-8065

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall m8320v5tkv

Malicious versions

1 flagged

0.0.1

Indicators of compromise (SHA-256)

a8588192c17e0334c16c77b4a833671fef88ccfe151128d1e8f6228bf1e2d927

ec74101680fcf955cff6c8efcdea538acd9615d7d249d7f9e7f48d717ce16739

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for m8320v5tkv (version 0.0.1).
If you installed it — respond
Remove m8320v5tkv from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If m8320v5tkv was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. m8320v5tkv on RubyGems has been identified as a malicious package (version 0.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-02716RLUA-2026-08564

References

github.com

Credits

ReversingLabs · finder

Detect & block this

O3 blocks m8320v5tkv-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database