Which versions of xabc0e407773 are malicious?

The following RubyGems versions of xabc0e407773 are flagged malicious: 0.0.1. Treat any of these as compromised.

How do I remediate xabc0e407773 if I installed it?

Remove xabc0e407773 from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed xabc0e407773 — how do I know if it already compromised me?

If xabc0e407773 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is xabc0e407773 part of a known attack campaign?

Yes — xabc0e407773 is associated with the RLMA-2026-04170, RLUA-2026-10103 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find xabc0e407773 across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for xabc0e407773 (version 0.0.1).

Malicious package

xabc0e407773RubyGems

Advisory published Jul 7, 2026Updated Sep 24, 2026

xabc0e407773 is a confirmed malicious RubyGems package (MAL-2026-9519) that executes malicious code on install (malicious version 0.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in xabc0e407773 (RubyGems)

MAL-2026-9519

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall xabc0e407773

Malicious versions

1 flagged

0.0.1

Indicators of compromise (SHA-256)

2b779fbcef4f42223dbb9f0866f038ed607e62ae6b98fdcd83d2816cfe1cbb74

6e11242de4d06b54a8fccc457b737a82118e62428b66eb4e1c1b8cf186949fd6

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for xabc0e407773 (version 0.0.1).
If you installed it — respond
Remove xabc0e407773 from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If xabc0e407773 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. xabc0e407773 on RubyGems has been identified as a malicious package (version 0.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-04170RLUA-2026-10103

References

github.com

Credits

ReversingLabs · finder

Detect & block this

O3 blocks xabc0e407773-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database