Which versions of saf368b4bc are malicious?

The following RubyGems versions of saf368b4bc are flagged malicious: 0.0.1. Treat any of these as compromised.

How do I remediate saf368b4bc if I installed it?

Remove saf368b4bc from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed saf368b4bc — how do I know if it already compromised me?

If saf368b4bc was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is saf368b4bc part of a known attack campaign?

Yes — saf368b4bc is associated with the RLMA-2026-03226, RLUA-2026-09120 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find saf368b4bc across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for saf368b4bc (version 0.0.1).

Malicious package

saf368b4bcRubyGems

Advisory published Jul 7, 2026Updated Sep 24, 2026

saf368b4bc is a confirmed malicious RubyGems package (MAL-2026-8575) that executes malicious code on install (malicious version 0.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in saf368b4bc (RubyGems)

MAL-2026-8575

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall saf368b4bc

Malicious versions

1 flagged

0.0.1

Indicators of compromise (SHA-256)

832fb191cdfeb55d7a745ef568e6e25557f8bfb2322c0ddf925e3f6c9c1fefbc

c8a647584c25e39ef74e63fcd01b2a47709abf2a0bfeed35b9bda77a5beef07c

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for saf368b4bc (version 0.0.1).
If you installed it — respond
Remove saf368b4bc from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If saf368b4bc was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. saf368b4bc on RubyGems has been identified as a malicious package (version 0.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-03226RLUA-2026-09120

References

github.com

Credits

ReversingLabs · finder

Detect & block this

O3 blocks saf368b4bc-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database