Which versions of mt8405aopw are malicious?

The following RubyGems versions of mt8405aopw are flagged malicious: 0.0.1. Treat any of these as compromised.

How do I remediate mt8405aopw if I installed it?

Remove mt8405aopw from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed mt8405aopw — how do I know if it already compromised me?

If mt8405aopw was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is mt8405aopw part of a known attack campaign?

Yes — mt8405aopw is associated with the RLMA-2026-02751, RLUA-2026-08611 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find mt8405aopw across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for mt8405aopw (version 0.0.1).

Malicious package

mt8405aopwRubyGems

Advisory published Jul 7, 2026Updated Sep 24, 2026

mt8405aopw is a confirmed malicious RubyGems package (MAL-2026-8100) that executes malicious code on install (malicious version 0.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in mt8405aopw (RubyGems)

MAL-2026-8100

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall mt8405aopw

Malicious versions

1 flagged

0.0.1

Indicators of compromise (SHA-256)

6c5df52fa5ebbfa782e93d6a391ae058d293bef1243616bbf614911440ce0db2

01fed45f0d85378c314ba3549ad8a6bce744b72a0ea1e7e9104e2efe8357c6ce

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for mt8405aopw (version 0.0.1).
If you installed it — respond
Remove mt8405aopw from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If mt8405aopw was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. mt8405aopw on RubyGems has been identified as a malicious package (version 0.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-02751RLUA-2026-08611

References

github.com

Credits

ReversingLabs · finder

Detect & block this

O3 blocks mt8405aopw-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database