Which versions of zexc4tj8o7ubol are malicious?

The following RubyGems versions of zexc4tj8o7ubol are flagged malicious: 0.0.1. Treat any of these as compromised.

How do I remediate zexc4tj8o7ubol if I installed it?

Remove zexc4tj8o7ubol from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed zexc4tj8o7ubol — how do I know if it already compromised me?

If zexc4tj8o7ubol was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is zexc4tj8o7ubol part of a known attack campaign?

Yes — zexc4tj8o7ubol is associated with the RLMA-2026-04215, RLUA-2026-10152 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find zexc4tj8o7ubol across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for zexc4tj8o7ubol (version 0.0.1).

Malicious package

zexc4tj8o7ubolRubyGems

Advisory published Jul 7, 2026Updated Sep 24, 2026

zexc4tj8o7ubol is a confirmed malicious RubyGems package (MAL-2026-9564) that executes malicious code on install (malicious version 0.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in zexc4tj8o7ubol (RubyGems)

MAL-2026-9564

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall zexc4tj8o7ubol

Malicious versions

1 flagged

0.0.1

Indicators of compromise (SHA-256)

c83dee734e3582c7daf76a9b921966920d2980864f62268976a8bd06b3491821

78d1e5ba52431d34297bf481389a343b93075747f46a617dbdeea0136d70ce68

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for zexc4tj8o7ubol (version 0.0.1).
If you installed it — respond
Remove zexc4tj8o7ubol from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If zexc4tj8o7ubol was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. zexc4tj8o7ubol on RubyGems has been identified as a malicious package (version 0.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-04215RLUA-2026-10152

References

github.com

Credits

ReversingLabs · finder

Detect & block this

O3 blocks zexc4tj8o7ubol-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database