Which versions of tmpxyz984024x are malicious?

The following RubyGems versions of tmpxyz984024x are flagged malicious: 0.0.1. Treat any of these as compromised.

How do I remediate tmpxyz984024x if I installed it?

Remove tmpxyz984024x from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed tmpxyz984024x — how do I know if it already compromised me?

If tmpxyz984024x was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is tmpxyz984024x part of a known attack campaign?

Yes — tmpxyz984024x is associated with the RLMA-2026-03653, RLUA-2026-09577 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find tmpxyz984024x across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for tmpxyz984024x (version 0.0.1).

Malicious package

tmpxyz984024xRubyGems

Advisory published Jul 7, 2026Updated Sep 24, 2026

tmpxyz984024x is a confirmed malicious RubyGems package (MAL-2026-9002) that executes malicious code on install (malicious version 0.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in tmpxyz984024x (RubyGems)

MAL-2026-9002

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall tmpxyz984024x

Malicious versions

1 flagged

0.0.1

Indicators of compromise (SHA-256)

896b16dd4af022ad1f24b1b55ca0896e2569553267489db0e400c4fc7af58239

c458517d15fbc0e05a56d63411b6bbb05529d1734393b657daba0850d3743ca3

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for tmpxyz984024x (version 0.0.1).
If you installed it — respond
Remove tmpxyz984024x from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If tmpxyz984024x was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. tmpxyz984024x on RubyGems has been identified as a malicious package (version 0.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-03653RLUA-2026-09577

References

github.com

Credits

ReversingLabs · finder

Detect & block this

O3 blocks tmpxyz984024x-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database