Which versions of prx975fe5e3fe are malicious?

The following RubyGems versions of prx975fe5e3fe are flagged malicious: 0.0.1. Treat any of these as compromised.

How do I remediate prx975fe5e3fe if I installed it?

Remove prx975fe5e3fe from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed prx975fe5e3fe — how do I know if it already compromised me?

If prx975fe5e3fe was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is prx975fe5e3fe part of a known attack campaign?

Yes — prx975fe5e3fe is associated with the RLMA-2026-03115, RLUA-2026-08990 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find prx975fe5e3fe across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for prx975fe5e3fe (version 0.0.1).

Malicious package

prx975fe5e3feRubyGems

Advisory published Jul 7, 2026Updated Sep 24, 2026

prx975fe5e3fe is a confirmed malicious RubyGems package (MAL-2026-8464) that executes malicious code on install (malicious version 0.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in prx975fe5e3fe (RubyGems)

MAL-2026-8464

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall prx975fe5e3fe

Malicious versions

1 flagged

0.0.1

Indicators of compromise (SHA-256)

a03485f9f6f62b71ab95c47a87e5c5cdf15f1a8e446bda9e533f30f390db3283

c9a5f487c779120f15d5ebd91744c98e6ea0bee478138a0a873c19eb0242434b

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for prx975fe5e3fe (version 0.0.1).
If you installed it — respond
Remove prx975fe5e3fe from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If prx975fe5e3fe was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. prx975fe5e3fe on RubyGems has been identified as a malicious package (version 0.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-03115RLUA-2026-08990

References

github.com

Credits

ReversingLabs · finder

Detect & block this

O3 blocks prx975fe5e3fe-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database