Which versions of swpdf130955fos are malicious?

The following RubyGems versions of swpdf130955fos are flagged malicious: 0.0.1. Treat any of these as compromised.

How do I remediate swpdf130955fos if I installed it?

Remove swpdf130955fos from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed swpdf130955fos — how do I know if it already compromised me?

If swpdf130955fos was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is swpdf130955fos part of a known attack campaign?

Yes — swpdf130955fos is associated with the RLMA-2026-03601, RLUA-2026-09514 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find swpdf130955fos across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for swpdf130955fos (version 0.0.1).

Malicious package

swpdf130955fosRubyGems

Advisory published Jul 7, 2026Updated Sep 24, 2026

swpdf130955fos is a confirmed malicious RubyGems package (MAL-2026-8950) that executes malicious code on install (malicious version 0.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in swpdf130955fos (RubyGems)

MAL-2026-8950

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall swpdf130955fos

Malicious versions

1 flagged

0.0.1

Indicators of compromise (SHA-256)

914df3839f5132fc29cc1a706b3d5b9d49938dd4bba74b9865d2f8179cf8ffec

d38075ee9ef8929175058e5a531836d3d79b1d49ab152a91a3909298f1294567

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for swpdf130955fos (version 0.0.1).
If you installed it — respond
Remove swpdf130955fos from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If swpdf130955fos was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. swpdf130955fos on RubyGems has been identified as a malicious package (version 0.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-03601RLUA-2026-09514

References

github.com

Credits

ReversingLabs · finder

Detect & block this

O3 blocks swpdf130955fos-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database