Which versions of maventa_common are malicious?

The following RubyGems versions of maventa_common are flagged malicious: 3.0.0, 4.0.0, 5.0.0. Treat any of these as compromised.

How do I remediate maventa_common if I installed it?

Remove maventa_common from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed maventa_common — how do I know if it already compromised me?

If maventa_common was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is maventa_common part of a known attack campaign?

Yes — maventa_common is associated with the RLMA-2025-03726, RLUA-2025-06618 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find maventa_common across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for maventa_common (3 malicious versions).

Malicious package

maventa_commonRubyGems

Advisory published Jul 31, 2025Updated Jul 23, 2026

maventa_common is a confirmed malicious RubyGems package (MAL-2025-6627) that executes malicious code on install (malicious versions 3.0.0, 4.0.0, 5.0.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in maventa_common (RubyGems)

MAL-2025-6627

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall maventa_common

Malicious versions

3 flagged

3.0.04.0.05.0.0

Indicators of compromise (SHA-256)

1741eb6bf5eb00c055204703bb49b08e9b07d3b43f78b090c1355872c5a4d2db

68fc0adc8f08412bdcd60354d8675f2939a3c512d06ece690559039f8b5b71b7

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for maventa_common (3 malicious versions).
If you installed it — respond
Remove maventa_common from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If maventa_common was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. maventa_common on RubyGems has been identified as a malicious package (versions 3.0.0, 4.0.0, 5.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2025-03726RLUA-2025-06618

References

intel.aikido.dev

Credits

ReversingLabs · finder

Detect & block this

O3 blocks maventa_common-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database