Malicious code in zzpdfvar03 (RubyGems)
Malicious code was discovered in the zzpdfvar03 RubyGems package. The package was identified by the OpenSSF malicious packages project and reported via GitHub Advisory GHSA-fjh2-hpmw-wvw7.
- Disclosed
- Last updated
- Blast radius
- Unknown scope; depends on adoption of affected versions
- Ecosystems
- Attack vectors
- Affected entities
- zzpdfvar03
The RubyGems package zzpdfvar03 was found to contain malicious code. The discovery was credited to the OpenSSF's malicious packages project, which maintains a catalog of known malicious software supply chain incidents.\n\nThe advisory was published on 2026-07-18 and assigned GitHub Advisory identifier GHSA-fjh2-hpmw-wvw7. The malicious package entry is tracked in the OpenSSF repository under MAL-2026-9960.\n\nThis represents a direct compromise of the package distribution, making it a critical supply chain risk for any Ruby application that may have installed affected versions.
Indicators of compromise
- Packages
- zzpdfvar03
Remediation
- Remove zzpdfvar03 from all Ruby projects and dependencies
- Audit project dependencies to identify any installations of zzpdfvar03
- Review application logs and system activity for any suspicious behavior from the time of installation
- Update to a safe alternative package if zzpdfvar03 was providing required functionality
- Ensure bundle.lock or similar dependency lock files are updated to exclude the malicious package
Sources
- GitHub Advisory GHSA-fjh2-hpmw-wvw7 · GitHub Advisory Database
Cite this entry
"Malicious code in zzpdfvar03 (RubyGems)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 18, 2026; last updated July 18, 2026. https://supplychainattack.org/incident/malicious-code-in-zzpdfvar03-rubygems-11p9ka
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in zzfadgivar05 (RubyGems)
Malicious code was discovered in the zzfadgivar05 RubyGems package. The package was identified by the OpenSSF malicious packages project and reported via GitHub Advisory GHSA-3gfr-fq7v-cc26.
RubyGemsCompromised package - resolvedcritical
Malicious code in zzjinavcsgit (RubyGems)
Malicious code was published in the zzjinavcsgit RubyGems package. The package was identified and cataloged by the OpenSSF malicious packages project.
RubyGemsCompromised package - resolvedcritical
Malicious code in zztest17785553702 (RubyGems)
Malicious code was discovered in the RubyGems package zztest17785553702. The package was identified and cataloged by the OpenSSF malicious packages project.
RubyGemsCompromised package - resolvedcritical
Malicious code in zzpdfvar01 (RubyGems)
Malicious code was discovered in the zzpdfvar01 RubyGems package. The package was identified by the OpenSSF malicious packages project and assigned identifier MAL-2026-9958.
RubyGemsCompromised package