Which versions of sgtyoqebjb are malicious?

The following RubyGems versions of sgtyoqebjb are flagged malicious: 0.0.1. Treat any of these as compromised.

How do I remediate sgtyoqebjb if I installed it?

Remove sgtyoqebjb from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed sgtyoqebjb — how do I know if it already compromised me?

If sgtyoqebjb was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is sgtyoqebjb part of a known attack campaign?

Yes — sgtyoqebjb is associated with the RLMA-2026-03271, RLUA-2026-09168 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find sgtyoqebjb across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for sgtyoqebjb (version 0.0.1).

Malicious package

sgtyoqebjbRubyGems

Advisory published Jul 7, 2026Updated Sep 24, 2026

sgtyoqebjb is a confirmed malicious RubyGems package (MAL-2026-8620) that executes malicious code on install (malicious version 0.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in sgtyoqebjb (RubyGems)

MAL-2026-8620

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall sgtyoqebjb

Malicious versions

1 flagged

0.0.1

Indicators of compromise (SHA-256)

ce8312add4d8b822be375365a15f7c1f9af0aa8e36f94a78152a22c081895be0

bc08797ad2326ff790ad7d2c9b2861bc34904b109be33752f01ae35c9c8bf21a

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for sgtyoqebjb (version 0.0.1).
If you installed it — respond
Remove sgtyoqebjb from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If sgtyoqebjb was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. sgtyoqebjb on RubyGems has been identified as a malicious package (version 0.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-03271RLUA-2026-09168

References

github.com

Credits

ReversingLabs · finder

Detect & block this

O3 blocks sgtyoqebjb-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database