Which versions of pd130985cmcb are malicious?

The following RubyGems versions of pd130985cmcb are flagged malicious: 0.0.1. Treat any of these as compromised.

How do I remediate pd130985cmcb if I installed it?

Remove pd130985cmcb from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed pd130985cmcb — how do I know if it already compromised me?

If pd130985cmcb was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is pd130985cmcb part of a known attack campaign?

Yes — pd130985cmcb is associated with the RLMA-2026-03068, RLUA-2026-08938 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find pd130985cmcb across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for pd130985cmcb (version 0.0.1).

Malicious package

pd130985cmcbRubyGems

Advisory published Jul 7, 2026Updated Sep 24, 2026

pd130985cmcb is a confirmed malicious RubyGems package (MAL-2026-8417) that executes malicious code on install (malicious version 0.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in pd130985cmcb (RubyGems)

MAL-2026-8417

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall pd130985cmcb

Malicious versions

1 flagged

0.0.1

Indicators of compromise (SHA-256)

c6b8cbe137375c1fcbef84a56c25f4761063f6a657c8a305022e516f5ce2875b

5e783632bd6d17fed7703c86a0617343daa9452d4d4ece485238078df55bb8d4

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for pd130985cmcb (version 0.0.1).
If you installed it — respond
Remove pd130985cmcb from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If pd130985cmcb was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. pd130985cmcb on RubyGems has been identified as a malicious package (version 0.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-03068RLUA-2026-08938

References

github.com

Credits

ReversingLabs · finder

Detect & block this

O3 blocks pd130985cmcb-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database