Malicious code in zzpdfvar02 (RubyGems)
Malicious code was discovered in the zzpdfvar02 package on RubyGems. The package contained intentional malicious functionality and was flagged by the OpenSSF malicious packages project.
- Disclosed
- Last updated
- Blast radius
- All users of the zzpdfvar02 RubyGems package
- Ecosystems
- Attack vectors
- Affected entities
- zzpdfvar02Malicious RubyGems package
The zzpdfvar02 package published on RubyGems was identified as containing malicious code. This incident was documented and credited to the OpenSSF's malicious packages project, which maintains a catalog of known malicious software supply chain incidents.\n\nThe malicious package was classified under OpenSSF's tracking system with identifier MAL-2026-9959. Users who installed this package may have been exposed to the malicious code embedded within it.\n\nThis represents a direct compromise of the package repository through publication of intentionally malicious code.
Indicators of compromise
- Packages
- zzpdfvar02
Remediation
- Remove the zzpdfvar02 package from any systems where it was installed
- Audit systems that may have executed code from this package for signs of compromise
- Review package dependencies to identify any reliance on zzpdfvar02
- Use only verified, trusted versions of required PDF libraries from reputable maintainers
- Implement package verification and scanning in your dependency management workflow
Sources
- GitHub Advisory GHSA-mpx3-mvr9-vmww · GitHub Advisory Database
Cite this entry
"Malicious code in zzpdfvar02 (RubyGems)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 18, 2026; last updated July 18, 2026. https://supplychainattack.org/incident/malicious-code-in-zzpdfvar02-rubygems-m0bh2k
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in zzfadgivar05 (RubyGems)
Malicious code was discovered in the zzfadgivar05 RubyGems package. The package was identified by the OpenSSF malicious packages project and reported via GitHub Advisory GHSA-3gfr-fq7v-cc26.
RubyGemsCompromised package - resolvedcritical
Malicious code in zzjinavcsgit (RubyGems)
Malicious code was published in the zzjinavcsgit RubyGems package. The package was identified and cataloged by the OpenSSF malicious packages project.
RubyGemsCompromised package - resolvedcritical
Malicious code in zztest17785553702 (RubyGems)
Malicious code was discovered in the RubyGems package zztest17785553702. The package was identified and cataloged by the OpenSSF malicious packages project.
RubyGemsCompromised package - resolvedcritical
Malicious code in zzpdfvar01 (RubyGems)
Malicious code was discovered in the zzpdfvar01 RubyGems package. The package was identified by the OpenSSF malicious packages project and assigned identifier MAL-2026-9958.
RubyGemsCompromised package