Which versions of swaim5a are malicious?

The following RubyGems versions of swaim5a are flagged malicious: 0.0.1. Treat any of these as compromised.

How do I remediate swaim5a if I installed it?

Remove swaim5a from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed swaim5a — how do I know if it already compromised me?

If swaim5a was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is swaim5a part of a known attack campaign?

Yes — swaim5a is associated with the RLMA-2026-03564, RLUA-2026-09477 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find swaim5a across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for swaim5a (version 0.0.1).

Malicious package

swaim5aRubyGems

Advisory published Jul 7, 2026Updated Sep 24, 2026

swaim5a is a confirmed malicious RubyGems package (MAL-2026-8913) that executes malicious code on install (malicious version 0.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in swaim5a (RubyGems)

MAL-2026-8913

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall swaim5a

Malicious versions

1 flagged

0.0.1

Indicators of compromise (SHA-256)

016f09becc769ee16e41e42d8e121c39f5b34c223cd9ef5b862ce454a345d090

063a761489fc349c6774e0b1752983e6c7f3dca2e90ade1690f6c683bd6d1f35

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for swaim5a (version 0.0.1).
If you installed it — respond
Remove swaim5a from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If swaim5a was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. swaim5a on RubyGems has been identified as a malicious package (version 0.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-03564RLUA-2026-09477

References

github.com

Credits

ReversingLabs · finder

Detect & block this

O3 blocks swaim5a-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database