Which versions of zbzrx48e5bd are malicious?

The following RubyGems versions of zbzrx48e5bd are flagged malicious: 0.0.1. Treat any of these as compromised.

How do I remediate zbzrx48e5bd if I installed it?

Remove zbzrx48e5bd from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed zbzrx48e5bd — how do I know if it already compromised me?

If zbzrx48e5bd was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is zbzrx48e5bd part of a known attack campaign?

Yes — zbzrx48e5bd is associated with the RLMA-2026-04214, RLUA-2026-10150 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find zbzrx48e5bd across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for zbzrx48e5bd (version 0.0.1).

Malicious package

zbzrx48e5bdRubyGems

Advisory published Jul 7, 2026Updated Sep 24, 2026

zbzrx48e5bd is a confirmed malicious RubyGems package (MAL-2026-9563) that executes malicious code on install (malicious version 0.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in zbzrx48e5bd (RubyGems)

MAL-2026-9563

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall zbzrx48e5bd

Malicious versions

1 flagged

0.0.1

Indicators of compromise (SHA-256)

13b98aed8b2029c5433163addd32139b927bcd735e52a58c8ffa33cd7e00e55d

c373409238a8ef838e0a71233a620827187a35c9d0bdd2208361c2d54c10249d

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for zbzrx48e5bd (version 0.0.1).
If you installed it — respond
Remove zbzrx48e5bd from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If zbzrx48e5bd was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. zbzrx48e5bd on RubyGems has been identified as a malicious package (version 0.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-04214RLUA-2026-10150

References

github.com

Credits

ReversingLabs · finder

Detect & block this

O3 blocks zbzrx48e5bd-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database