Malicious code in zzpdfvar11 (RubyGems)
Malicious code was discovered in the zzpdfvar11 RubyGems package. The package was identified by the OpenSSF malicious-packages project and assigned identifier MAL-2026-9968.
- Disclosed
- Last updated
- Blast radius
- All users of the zzpdfvar11 RubyGems package
- Ecosystems
- Attack vectors
- Affected entities
- zzpdfvar11RubyGems package
The zzpdfvar11 package on RubyGems was found to contain malicious code. This incident was identified and documented by the OpenSSF's malicious-packages project, a collaborative effort to track and catalog known malicious software packages across package ecosystems.\n\nThe malicious package was assigned the identifier MAL-2026-9968 and published as a GitHub Security Advisory (GHSA-v98x-crcq-8xmv). The discovery was credited to the OpenSSF initiative.\n\nAny system that installed or used the zzpdfvar11 package may have been affected by the malicious code.
Indicators of compromise
- Packages
- zzpdfvar11
Remediation
- Remove the zzpdfvar11 package from all systems where it was installed
- Audit systems that had zzpdfvar11 installed for signs of compromise
- Review application dependencies to ensure no reliance on zzpdfvar11
- Update to a safe alternative package if zzpdfvar11 was providing required functionality
Sources
- GitHub Advisory GHSA-v98x-crcq-8xmv · GitHub Advisory Database
Cite this entry
"Malicious code in zzpdfvar11 (RubyGems)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 18, 2026; last updated July 18, 2026. https://supplychainattack.org/incident/malicious-code-in-zzpdfvar11-rubygems-59gjiu
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in zzfadgivar05 (RubyGems)
Malicious code was discovered in the zzfadgivar05 RubyGems package. The package was identified by the OpenSSF malicious packages project and reported via GitHub Advisory GHSA-3gfr-fq7v-cc26.
RubyGemsCompromised package - resolvedcritical
Malicious code in zzjinavcsgit (RubyGems)
Malicious code was published in the zzjinavcsgit RubyGems package. The package was identified and cataloged by the OpenSSF malicious packages project.
RubyGemsCompromised package - resolvedcritical
Malicious code in zztest17785553702 (RubyGems)
Malicious code was discovered in the RubyGems package zztest17785553702. The package was identified and cataloged by the OpenSSF malicious packages project.
RubyGemsCompromised package - resolvedcritical
Malicious code in zzpdfvar01 (RubyGems)
Malicious code was discovered in the zzpdfvar01 RubyGems package. The package was identified by the OpenSSF malicious packages project and assigned identifier MAL-2026-9958.
RubyGemsCompromised package