Which versions of oailme are malicious?

The following RubyGems versions of oailme are flagged malicious: 0.0.1. Treat any of these as compromised.

How do I remediate oailme if I installed it?

Remove oailme from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed oailme — how do I know if it already compromised me?

If oailme was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is oailme part of a known attack campaign?

Yes — oailme is associated with the RLMA-2026-02950, RLUA-2026-08814 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find oailme across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for oailme (version 0.0.1).

Malicious package

oailmeRubyGems

Advisory published Jul 7, 2026Updated Sep 24, 2026

oailme is a confirmed malicious RubyGems package (MAL-2026-8299) that executes malicious code on install (malicious version 0.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in oailme (RubyGems)

MAL-2026-8299

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall oailme

Malicious versions

1 flagged

0.0.1

Indicators of compromise (SHA-256)

82110fc50a0556045c7167c6a7e200d73887e2f65d79955786dd6e89cef8a62d

55973c36c7aafa02ba9df443dfe67439517683299bc747deae5b25405d877a24

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for oailme (version 0.0.1).
If you installed it — respond
Remove oailme from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If oailme was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. oailme on RubyGems has been identified as a malicious package (version 0.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-02950RLUA-2026-08814

References

github.com

Credits

ReversingLabs · finder

Detect & block this

O3 blocks oailme-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database