Which versions of zpdfraweb1fde9y are malicious?

The following RubyGems versions of zpdfraweb1fde9y are flagged malicious: 0.0.1. Treat any of these as compromised.

How do I remediate zpdfraweb1fde9y if I installed it?

Remove zpdfraweb1fde9y from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed zpdfraweb1fde9y — how do I know if it already compromised me?

If zpdfraweb1fde9y was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is zpdfraweb1fde9y part of a known attack campaign?

Yes — zpdfraweb1fde9y is associated with the RLMA-2026-04318, RLUA-2026-10256 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find zpdfraweb1fde9y across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for zpdfraweb1fde9y (version 0.0.1).

Malicious package

zpdfraweb1fde9yRubyGems

Advisory published Jul 7, 2026Updated Sep 24, 2026

zpdfraweb1fde9y is a confirmed malicious RubyGems package (MAL-2026-9667) that executes malicious code on install (malicious version 0.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in zpdfraweb1fde9y (RubyGems)

MAL-2026-9667

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall zpdfraweb1fde9y

Malicious versions

1 flagged

0.0.1

Indicators of compromise (SHA-256)

77be27ca91f6ec21a54afe7a90437dfa5f5e27512a081241f4765a372c7b1d3c

1a8be07b0a7a4422234aaa26415a015217528f2490c3d546a34941d0f74d78ef

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for zpdfraweb1fde9y (version 0.0.1).
If you installed it — respond
Remove zpdfraweb1fde9y from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If zpdfraweb1fde9y was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. zpdfraweb1fde9y on RubyGems has been identified as a malicious package (version 0.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-04318RLUA-2026-10256

References

github.com

Credits

ReversingLabs · finder

Detect & block this

O3 blocks zpdfraweb1fde9y-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database