Which versions of rollbar-blanket are malicious?

The following RubyGems versions of rollbar-blanket are flagged malicious: 22.55.2. Treat any of these as compromised.

How do I remediate rollbar-blanket if I installed it?

Remove rollbar-blanket from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed rollbar-blanket — how do I know if it already compromised me?

If rollbar-blanket was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is rollbar-blanket part of a known attack campaign?

Yes — rollbar-blanket is associated with the RLMA-2024-05818, RLUA-2024-10339, RLUA-2026-09070 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find rollbar-blanket across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for rollbar-blanket (version 22.55.2).

Malicious package

rollbar-blanketRubyGems

Advisory published Jun 25, 2024Updated Sep 24, 2026

rollbar-blanket is a confirmed malicious RubyGems package (MAL-2024-7013) that executes malicious code on install (malicious version 22.55.2). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in rollbar-blanket (RubyGems)

MAL-2024-7013

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall rollbar-blanket

Malicious versions

1 flagged

22.55.2

Indicators of compromise (SHA-256)

bae08038fc8fca975254b17168b1eac348191205ce7e92a16908ee8e34932b30

2d74bd125dc9b47f8bb52f5f6d5277700221721bfa44e972b370605d96dcd8dd

3b6bd4f141960cd94664a5d0e0363ad985756c8c9b9bd3874cb821d4a4691a2f

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for rollbar-blanket (version 22.55.2).
If you installed it — respond
Remove rollbar-blanket from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If rollbar-blanket was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. rollbar-blanket on RubyGems has been identified as a malicious package (version 22.55.2 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2024-05818RLUA-2024-10339RLUA-2026-09070

References

github.com

Credits

ReversingLabs · finder

Detect & block this

O3 blocks rollbar-blanket-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database