Which versions of oaklfscr are malicious?

The following RubyGems versions of oaklfscr are flagged malicious: 0.0.1. Treat any of these as compromised.

How do I remediate oaklfscr if I installed it?

Remove oaklfscr from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed oaklfscr — how do I know if it already compromised me?

If oaklfscr was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is oaklfscr part of a known attack campaign?

Yes — oaklfscr is associated with the RLMA-2026-03021, RLUA-2026-08885 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find oaklfscr across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for oaklfscr (version 0.0.1).

Malicious package

oaklfscrRubyGems

Advisory published Jul 7, 2026Updated Sep 24, 2026

oaklfscr is a confirmed malicious RubyGems package (MAL-2026-8370) that executes malicious code on install (malicious version 0.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in oaklfscr (RubyGems)

MAL-2026-8370

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall oaklfscr

Malicious versions

1 flagged

0.0.1

Indicators of compromise (SHA-256)

cc7b3c947fd630eab30acbbce37b917eef5946c5e4556a20a9d97d68658f4382

5e517016a726f0daee0c8c6707a488e08391f2330ff6e738f6ac00ac31c2ecf5

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for oaklfscr (version 0.0.1).
If you installed it — respond
Remove oaklfscr from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If oaklfscr was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. oaklfscr on RubyGems has been identified as a malicious package (version 0.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-03021RLUA-2026-08885

References

github.com

Credits

ReversingLabs · finder

Detect & block this

O3 blocks oaklfscr-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database