Which versions of zjpath80 are malicious?

The following RubyGems versions of zjpath80 are flagged malicious: 0.0.1. Treat any of these as compromised.

How do I remediate zjpath80 if I installed it?

Remove zjpath80 from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed zjpath80 — how do I know if it already compromised me?

If zjpath80 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is zjpath80 part of a known attack campaign?

Yes — zjpath80 is associated with the RLMA-2026-04264, RLUA-2026-10201 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find zjpath80 across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for zjpath80 (version 0.0.1).

Malicious package

zjpath80RubyGems

Advisory published Jul 7, 2026Updated Sep 24, 2026

zjpath80 is a confirmed malicious RubyGems package (MAL-2026-9613) that executes malicious code on install (malicious version 0.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in zjpath80 (RubyGems)

MAL-2026-9613

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall zjpath80

Malicious versions

1 flagged

0.0.1

Indicators of compromise (SHA-256)

68b0f126ea7443faeec3976dcda0df18a16e860524fccb5deff08e8282e41dd4

fea92a094de8f7af0cf4d57af79a803517aa333f26060fee00356d633f788b1b

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for zjpath80 (version 0.0.1).
If you installed it — respond
Remove zjpath80 from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If zjpath80 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. zjpath80 on RubyGems has been identified as a malicious package (version 0.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-04264RLUA-2026-10201

References

Credits

ReversingLabs · finder

Detect & block this

O3 blocks zjpath80-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database