Which versions of probe1778554668 are malicious?

The following RubyGems versions of probe1778554668 are flagged malicious: 0.0.1. Treat any of these as compromised.

How do I remediate probe1778554668 if I installed it?

Remove probe1778554668 from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed probe1778554668 — how do I know if it already compromised me?

If probe1778554668 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is probe1778554668 part of a known attack campaign?

Yes — probe1778554668 is associated with the RLMA-2026-03077, RLUA-2026-08950 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find probe1778554668 across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for probe1778554668 (version 0.0.1).

Malicious package

probe1778554668RubyGems

Advisory published Jul 7, 2026Updated Sep 24, 2026

probe1778554668 is a confirmed malicious RubyGems package (MAL-2026-8426) that executes malicious code on install (malicious version 0.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in probe1778554668 (RubyGems)

MAL-2026-8426

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall probe1778554668

Malicious versions

1 flagged

0.0.1

Indicators of compromise (SHA-256)

b1615164d9c154f43ab6208faa8c461fdf6e24e7818bd601e83e54fc39d71da8

a8a2bf52f86bb3a98ae909faa877fff0857d798e52b2e0c1d5133fb947cde6ef

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for probe1778554668 (version 0.0.1).
If you installed it — respond
Remove probe1778554668 from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If probe1778554668 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. probe1778554668 on RubyGems has been identified as a malicious package (version 0.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-03077RLUA-2026-08950

References

github.com

Credits

ReversingLabs · finder

Detect & block this

O3 blocks probe1778554668-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database