Which versions of zrzxe65778 are malicious?

The following RubyGems versions of zrzxe65778 are flagged malicious: 0.0.1. Treat any of these as compromised.

How do I remediate zrzxe65778 if I installed it?

Remove zrzxe65778 from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed zrzxe65778 — how do I know if it already compromised me?

If zrzxe65778 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is zrzxe65778 part of a known attack campaign?

Yes — zrzxe65778 is associated with the RLMA-2026-04433, RLUA-2026-10371 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find zrzxe65778 across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for zrzxe65778 (version 0.0.1).

Malicious package

zrzxe65778RubyGems

Advisory published Jul 7, 2026Updated Sep 24, 2026

zrzxe65778 is a confirmed malicious RubyGems package (MAL-2026-9782) that executes malicious code on install (malicious version 0.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in zrzxe65778 (RubyGems)

MAL-2026-9782

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall zrzxe65778

Malicious versions

1 flagged

0.0.1

Indicators of compromise (SHA-256)

2b96509b960262207c62163d6681db9076e947b23ed73da3c9fb45628534e658

2bdf4915ea1b1d01992d5cb80ce7700f1b503f2036c2fd2794af5ea4730ee840

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for zrzxe65778 (version 0.0.1).
If you installed it — respond
Remove zrzxe65778 from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If zrzxe65778 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. zrzxe65778 on RubyGems has been identified as a malicious package (version 0.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-04433RLUA-2026-10371

References

github.com

Credits

ReversingLabs · finder

Detect & block this

O3 blocks zrzxe65778-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database