Which versions of slnstep8375 are malicious?

The following RubyGems versions of slnstep8375 are flagged malicious: 0.0.1. Treat any of these as compromised.

How do I remediate slnstep8375 if I installed it?

Remove slnstep8375 from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed slnstep8375 — how do I know if it already compromised me?

If slnstep8375 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is slnstep8375 part of a known attack campaign?

Yes — slnstep8375 is associated with the RLMA-2026-03408, RLUA-2026-09306 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find slnstep8375 across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for slnstep8375 (version 0.0.1).

Malicious package

slnstep8375RubyGems

Advisory published Jul 7, 2026Updated Sep 24, 2026

slnstep8375 is a confirmed malicious RubyGems package (MAL-2026-8757) that executes malicious code on install (malicious version 0.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in slnstep8375 (RubyGems)

MAL-2026-8757

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall slnstep8375

Malicious versions

1 flagged

0.0.1

Indicators of compromise (SHA-256)

36c939e4d81551d55092443764fa7739df96f85fe7cfd882293b12b18c3bd574

918753f2f3b5c48c46f93350938d81b839332db5994597e98f070b1dddff0941

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for slnstep8375 (version 0.0.1).
If you installed it — respond
Remove slnstep8375 from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If slnstep8375 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. slnstep8375 on RubyGems has been identified as a malicious package (version 0.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-03408RLUA-2026-09306

References

github.com

Credits

ReversingLabs · finder

Detect & block this

O3 blocks slnstep8375-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database