Which versions of zrgvbi2729 are malicious?

The following RubyGems versions of zrgvbi2729 are flagged malicious: 0.0.1. Treat any of these as compromised.

How do I remediate zrgvbi2729 if I installed it?

Remove zrgvbi2729 from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed zrgvbi2729 — how do I know if it already compromised me?

If zrgvbi2729 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is zrgvbi2729 part of a known attack campaign?

Yes — zrgvbi2729 is associated with the RLMA-2026-04353, RLUA-2026-10291 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find zrgvbi2729 across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for zrgvbi2729 (version 0.0.1).

Malicious package

zrgvbi2729RubyGems

Advisory published Jul 7, 2026Updated Sep 24, 2026

zrgvbi2729 is a confirmed malicious RubyGems package (MAL-2026-9702) that executes malicious code on install (malicious version 0.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in zrgvbi2729 (RubyGems)

MAL-2026-9702

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall zrgvbi2729

Malicious versions

1 flagged

0.0.1

Indicators of compromise (SHA-256)

d0c7265c265bd16c46e62df268736a29373d6ddf71df2b80ce83cc3e9bb891d7

fe908c33c3d9e04a7712c93efe4aa6f5d04df88669c33099f4604645fdd556b8

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for zrgvbi2729 (version 0.0.1).
If you installed it — respond
Remove zrgvbi2729 from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If zrgvbi2729 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. zrgvbi2729 on RubyGems has been identified as a malicious package (version 0.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-04353RLUA-2026-10291

References

github.com

Credits

ReversingLabs · finder

Detect & block this

O3 blocks zrgvbi2729-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database