Which versions of zmarinapxy1778553025 are malicious?

The following RubyGems versions of zmarinapxy1778553025 are flagged malicious: 0.0.1. Treat any of these as compromised.

How do I remediate zmarinapxy1778553025 if I installed it?

Remove zmarinapxy1778553025 from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed zmarinapxy1778553025 — how do I know if it already compromised me?

If zmarinapxy1778553025 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is zmarinapxy1778553025 part of a known attack campaign?

Yes — zmarinapxy1778553025 is associated with the RLMA-2026-04313, RLUA-2026-10250 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find zmarinapxy1778553025 across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for zmarinapxy1778553025 (version 0.0.1).

Malicious package

zmarinapxy1778553025RubyGems

Advisory published Jul 7, 2026Updated Sep 24, 2026

zmarinapxy1778553025 is a confirmed malicious RubyGems package (MAL-2026-9662) that executes malicious code on install (malicious version 0.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in zmarinapxy1778553025 (RubyGems)

MAL-2026-9662

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall zmarinapxy1778553025

Malicious versions

1 flagged

0.0.1

Indicators of compromise (SHA-256)

d658288a07d92ad27f0f146610340e7ecc248b9f19c9610af33221ac87cf7fdd

384d2cc6094b44e9c38d0834d28fa2a15e7389917a24a031b3a43ada6408d7f8

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for zmarinapxy1778553025 (version 0.0.1).
If you installed it — respond
Remove zmarinapxy1778553025 from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If zmarinapxy1778553025 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. zmarinapxy1778553025 on RubyGems has been identified as a malicious package (version 0.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-04313RLUA-2026-10250

References

github.com

Credits

ReversingLabs · finder

Detect & block this

O3 blocks zmarinapxy1778553025-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database