Which versions of zsweblist25949 are malicious?

The following RubyGems versions of zsweblist25949 are flagged malicious: 0.0.1. Treat any of these as compromised.

How do I remediate zsweblist25949 if I installed it?

Remove zsweblist25949 from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed zsweblist25949 — how do I know if it already compromised me?

If zsweblist25949 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is zsweblist25949 part of a known attack campaign?

Yes — zsweblist25949 is associated with the RLMA-2026-04452, RLUA-2026-10390 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find zsweblist25949 across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for zsweblist25949 (version 0.0.1).

Malicious package

zsweblist25949RubyGems

Advisory published Jul 7, 2026Updated Sep 24, 2026

zsweblist25949 is a confirmed malicious RubyGems package (MAL-2026-9801) that executes malicious code on install (malicious version 0.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in zsweblist25949 (RubyGems)

MAL-2026-9801

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall zsweblist25949

Malicious versions

1 flagged

0.0.1

Indicators of compromise (SHA-256)

ce232d4d4b0d1e7ab27fc2b8484278d37ce40c38fa8a6581af55c57810090494

0f359127eee85d1f404016fce8b6db6faab7cdf6722ded77811ab064ba7badbc

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for zsweblist25949 (version 0.0.1).
If you installed it — respond
Remove zsweblist25949 from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If zsweblist25949 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. zsweblist25949 on RubyGems has been identified as a malicious package (version 0.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-04452RLUA-2026-10390

References

github.com

Credits

ReversingLabs · finder

Detect & block this

O3 blocks zsweblist25949-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database