Which versions of my_shoaib_gem are malicious?

The following RubyGems versions of my_shoaib_gem are flagged malicious: 0.1.0, 1.0.1, 1.1.1, 1.1.2, 1.2.2. Treat any of these as compromised.

How do I remediate my_shoaib_gem if I installed it?

Remove my_shoaib_gem from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed my_shoaib_gem — how do I know if it already compromised me?

If my_shoaib_gem was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is my_shoaib_gem part of a known attack campaign?

Yes — my_shoaib_gem is associated with the RLMA-2026-05394 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find my_shoaib_gem across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for my_shoaib_gem (5 malicious versions).

Malicious package

my_shoaib_gemRubyGems

Advisory published Jul 20, 2026Updated Jul 23, 2026

my_shoaib_gem is a confirmed malicious RubyGems package (MAL-2026-10914) that executes malicious code on install (malicious versions 0.1.0, 1.0.1, 1.1.1…). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in my_shoaib_gem (RubyGems)

MAL-2026-10914

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall my_shoaib_gem

Malicious versions

5 flagged

0.1.01.0.11.1.11.1.21.2.2

Indicators of compromise (SHA-256)

7eb65c41c879c3802df349a4c723b7a146428ca210184dc2fe6833590b484e24

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for my_shoaib_gem (5 malicious versions).
If you installed it — respond
Remove my_shoaib_gem from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If my_shoaib_gem was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. my_shoaib_gem on RubyGems has been identified as a malicious package (versions 0.1.0, 1.0.1, 1.1.1, 1.1.2, 1.2.2 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-05394

References

intel.aikido.dev

Credits

ReversingLabs · finder

Detect & block this

O3 blocks my_shoaib_gem-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database