Which versions of stuck-it_up are malicious?

The following RubyGems versions of stuck-it_up are flagged malicious: 0.1.0. Treat any of these as compromised.

How do I remediate stuck-it_up if I installed it?

Remove stuck-it_up from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed stuck-it_up — how do I know if it already compromised me?

If stuck-it_up was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is stuck-it_up part of a known attack campaign?

Yes — stuck-it_up is associated with the RLMA-2024-05836, RLUA-2024-10357, RLUA-2026-09469 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find stuck-it_up across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for stuck-it_up (version 0.1.0).

Malicious package

stuck-it_upRubyGems

Advisory published Jun 25, 2024Updated Sep 24, 2026

stuck-it_up is a confirmed malicious RubyGems package (MAL-2024-7031) that executes malicious code on install (malicious version 0.1.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in stuck-it_up (RubyGems)

MAL-2024-7031

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall stuck-it_up

Malicious versions

1 flagged

0.1.0

Indicators of compromise (SHA-256)

ffb952e9c4ebffaab70a3760dae202c503e1e867b3af755729391e36a39a2f8a

6531d198e587669a8630d941ce37dc497a9a5a4606251633f85788d921e40102

13c51e95bacc95e3e4bca67d9ee35c0b2d609d3f488a8478ff15faa7c74de09c

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for stuck-it_up (version 0.1.0).
If you installed it — respond
Remove stuck-it_up from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If stuck-it_up was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. stuck-it_up on RubyGems has been identified as a malicious package (version 0.1.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2024-05836RLUA-2024-10357RLUA-2026-09469

References

Credits

ReversingLabs · finder

Detect & block this

O3 blocks stuck-it_up-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database