Which versions of multi-movingsign are malicious?

The following RubyGems versions of multi-movingsign are flagged malicious: 0.0.1. Treat any of these as compromised.

How do I remediate multi-movingsign if I installed it?

Remove multi-movingsign from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed multi-movingsign — how do I know if it already compromised me?

If multi-movingsign was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is multi-movingsign part of a known attack campaign?

Yes — multi-movingsign is associated with the RLMA-2024-05800, RLUA-2024-10321, RLUA-2026-08612 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find multi-movingsign across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for multi-movingsign (version 0.0.1).

Malicious package

multi-movingsignRubyGems

Advisory published Jun 25, 2024Updated Sep 24, 2026

multi-movingsign is a confirmed malicious RubyGems package (MAL-2024-6994) that executes malicious code on install (malicious version 0.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in multi-movingsign (RubyGems)

MAL-2024-6994

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall multi-movingsign

Malicious versions

1 flagged

0.0.1

Indicators of compromise (SHA-256)

5f65bdc0a362f84f625d1660d4db2277ef926807f54793800489fb965139a10a

9680f26a0a82587fe046e14ed1d040151150f811463b59f4b7146be4d278a205

c2633b1e5ddd653590efb32e411c9e23957ecdeec5ee4f29532bde0d52f49a63

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for multi-movingsign (version 0.0.1).
If you installed it — respond
Remove multi-movingsign from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If multi-movingsign was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. multi-movingsign on RubyGems has been identified as a malicious package (version 0.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2024-05800RLUA-2024-10321RLUA-2026-08612

References

Credits

ReversingLabs · finder

Detect & block this

O3 blocks multi-movingsign-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database