Malicious code in zzzltestfoobarxyz (RubyGems)
Malicious code was published in the zzzltestfoobarxyz RubyGems package. The package was identified and cataloged by the OpenSSF malicious packages project.
- Disclosed
- Last updated
- Blast radius
- Unknown scope; appears to be a test/demonstration package
- Ecosystems
- Attack vectors
- Affected entities
- zzzltestfoobarxyz
A RubyGems package named zzzltestfoobarxyz was found to contain malicious code. The incident was identified and documented by the OpenSSF's malicious packages project, which maintains a public catalog of known malicious software supply chain incidents.\n\nThe package was published to the RubyGems repository and flagged as containing malicious code. Based on the package name and OpenSSF classification, this appears to be part of a test or demonstration dataset rather than a production attack, though it was treated with critical severity.\n\nThe incident has been documented in the OpenSSF malicious packages repository under identifier MAL-2026-10005.
Indicators of compromise
- Packages
- zzzltestfoobarxyz
Remediation
- Remove or uninstall the zzzltestfoobarxyz package from any systems where it may have been installed
- Review dependency manifests to ensure this package was not included as a transitive dependency
- Consult the OpenSSF malicious packages database for the full technical details and any indicators of compromise
Sources
- GitHub Advisory GHSA-g99x-552p-cw68 · GitHub Advisory Database
Cite this entry
"Malicious code in zzzltestfoobarxyz (RubyGems)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 18, 2026; last updated July 18, 2026. https://supplychainattack.org/incident/malicious-code-in-zzzltestfoobarxyz-rubygems-of63m8
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in zzfadgivar05 (RubyGems)
Malicious code was discovered in the zzfadgivar05 RubyGems package. The package was identified by the OpenSSF malicious packages project and reported via GitHub Advisory GHSA-3gfr-fq7v-cc26.
RubyGemsCompromised package - resolvedcritical
Malicious code in zzjinavcsgit (RubyGems)
Malicious code was published in the zzjinavcsgit RubyGems package. The package was identified and cataloged by the OpenSSF malicious packages project.
RubyGemsCompromised package - resolvedcritical
Malicious code in zztest17785553702 (RubyGems)
Malicious code was discovered in the RubyGems package zztest17785553702. The package was identified and cataloged by the OpenSSF malicious packages project.
RubyGemsCompromised package - resolvedcritical
Malicious code in zzpdfvar01 (RubyGems)
Malicious code was discovered in the zzpdfvar01 RubyGems package. The package was identified by the OpenSSF malicious packages project and assigned identifier MAL-2026-9958.
RubyGemsCompromised package