Which versions of wandqhack3 are malicious?

The following RubyGems versions of wandqhack3 are flagged malicious: 0.0.1. Treat any of these as compromised.

How do I remediate wandqhack3 if I installed it?

Remove wandqhack3 from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed wandqhack3 — how do I know if it already compromised me?

If wandqhack3 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is wandqhack3 part of a known attack campaign?

Yes — wandqhack3 is associated with the RLMA-2026-03901, RLUA-2026-09831 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find wandqhack3 across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for wandqhack3 (version 0.0.1).

Malicious package

wandqhack3RubyGems

Advisory published Jul 7, 2026Updated Sep 24, 2026

wandqhack3 is a confirmed malicious RubyGems package (MAL-2026-9250) that executes malicious code on install (malicious version 0.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in wandqhack3 (RubyGems)

MAL-2026-9250

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall wandqhack3

Malicious versions

1 flagged

0.0.1

Indicators of compromise (SHA-256)

aa6c4b3ef74f0c27bb8341a8f0c3cfe13d52fc8279a0899934e9ad65091cb0ef

d852d7e689a32e98a1cd6cbb3c608ead04af1f7e283663eacdf18ad07d199fc6

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for wandqhack3 (version 0.0.1).
If you installed it — respond
Remove wandqhack3 from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If wandqhack3 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. wandqhack3 on RubyGems has been identified as a malicious package (version 0.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-03901RLUA-2026-09831

References

github.com

Credits

ReversingLabs · finder

Detect & block this

O3 blocks wandqhack3-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database