Which versions of wp886 are malicious?

The following RubyGems versions of wp886 are flagged malicious: 0.0.1. Treat any of these as compromised.

How do I remediate wp886 if I installed it?

Remove wp886 from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed wp886 — how do I know if it already compromised me?

If wp886 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is wp886 part of a known attack campaign?

Yes — wp886 is associated with the RLMA-2026-04079, RLUA-2026-10011 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find wp886 across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for wp886 (version 0.0.1).

Malicious package

wp886RubyGems

Advisory published Jul 7, 2026Updated Sep 24, 2026

wp886 is a confirmed malicious RubyGems package (MAL-2026-9428) that executes malicious code on install (malicious version 0.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in wp886 (RubyGems)

MAL-2026-9428

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall wp886

Malicious versions

1 flagged

0.0.1

Indicators of compromise (SHA-256)

5a5e4f4096dda8d4539a699cfff4375210b8e4ee092a156de086b7145eaebebd

b9947228bf0efb517edd3ac66ec1014572bb6d898961feea651d57785224ddfa

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for wp886 (version 0.0.1).
If you installed it — respond
Remove wp886 from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If wp886 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. wp886 on RubyGems has been identified as a malicious package (version 0.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-04079RLUA-2026-10011

References

github.com

Credits

ReversingLabs · finder

Detect & block this

O3 blocks wp886-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database