Which versions of testcatplzignore are malicious?

The following RubyGems versions of testcatplzignore are flagged malicious: 0.0.1. Treat any of these as compromised.

How do I remediate testcatplzignore if I installed it?

Remove testcatplzignore from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed testcatplzignore — how do I know if it already compromised me?

If testcatplzignore was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is testcatplzignore part of a known attack campaign?

Yes — testcatplzignore is associated with the RLMA-2026-00960, RLUA-2026-09544 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find testcatplzignore across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for testcatplzignore (version 0.0.1).

Malicious package

testcatplzignoreRubyGems

Advisory published Mar 18, 2026Updated Sep 24, 2026

testcatplzignore is a confirmed malicious RubyGems package (MAL-2026-1924) that executes malicious code on install (malicious version 0.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in testcatplzignore (RubyGems)

MAL-2026-1924

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall testcatplzignore

Malicious versions

1 flagged

0.0.1

Indicators of compromise (SHA-256)

98b896d39a2625f5dd23827409751efe377229b2fcd964268eac212e9722c49f

77ec377f719dea3e9f77fddf50d47f9bf8fb2190ec5a0400f588d5c282313313

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for testcatplzignore (version 0.0.1).
If you installed it — respond
Remove testcatplzignore from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If testcatplzignore was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. testcatplzignore on RubyGems has been identified as a malicious package (version 0.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-00960RLUA-2026-09544

References

github.com

Credits

ReversingLabs · finder

Detect & block this

O3 blocks testcatplzignore-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database