Which versions of zzpdfvar15 are malicious?

The following RubyGems versions of zzpdfvar15 are flagged malicious: 0.0.1. Treat any of these as compromised.

How do I remediate zzpdfvar15 if I installed it?

Remove zzpdfvar15 from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed zzpdfvar15 — how do I know if it already compromised me?

If zzpdfvar15 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is zzpdfvar15 part of a known attack campaign?

Yes — zzpdfvar15 is associated with the RLMA-2026-04623, RLUA-2026-10561 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find zzpdfvar15 across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for zzpdfvar15 (version 0.0.1).

Malicious package

zzpdfvar15RubyGems

Advisory published Jul 7, 2026Updated Sep 24, 2026

zzpdfvar15 is a confirmed malicious RubyGems package (MAL-2026-9972) that executes malicious code on install (malicious version 0.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in zzpdfvar15 (RubyGems)

MAL-2026-9972

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall zzpdfvar15

Malicious versions

1 flagged

0.0.1

Indicators of compromise (SHA-256)

806408e28d7b9edf999a412ea389029b049f1c8e78b989a05b6a296ec4045d42

b599856678af8c17f9261f2b454818222db612384bad10c22beea64a2ee9083d

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for zzpdfvar15 (version 0.0.1).
If you installed it — respond
Remove zzpdfvar15 from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If zzpdfvar15 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. zzpdfvar15 on RubyGems has been identified as a malicious package (version 0.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-04623RLUA-2026-10561

References

Credits

ReversingLabs · finder

Detect & block this

O3 blocks zzpdfvar15-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database