Security feed

Back to latest events

24 October 2026

advisoryUnratedOSV24 Oct 2026

Malicious code in injecthack1778550335 (RubyGems)

--- _-= Per source details. Do not edit below this line.=-_

Announced 7 Jul 2026

injecthack1778550335

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:MAL-2026-7778

injecthack1778550335

Source reference: /affected/0/package/name

Affected versions: 0.0.1
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Publisher severity

No explicit severity was provided.

Event: #6589 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:30:08 GMT
Publisher date: Tue, 07 Jul 2026 11:53:55 GMT

Read the original announcement

advisoryUnratedOSV24 Oct 2026

Malicious code in hwc4v (RubyGems)

--- _-= Per source details. Do not edit below this line.=-_

Announced 7 Jul 2026

hwc4v

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:MAL-2026-7772

hwc4v

Source reference: /affected/0/package/name

Affected versions: 0.0.1
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Publisher severity

No explicit severity was provided.

Event: #6588 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:30:07 GMT
Publisher date: Tue, 07 Jul 2026 11:53:50 GMT

Read the original announcement

advisoryUnratedOSV24 Oct 2026

Malicious code in jdbc-zzz (RubyGems)

--- _-= Per source details. Do not edit below this line.=-_

Announced 18 Jun 2025

jdbc-zzz

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:MAL-2025-5145

jdbc-zzz

Source reference: /affected/0/package/name

Affected versions: 9.9.9
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Publisher severity

No explicit severity was provided.

Event: #6587 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:30:07 GMT
Publisher date: Wed, 18 Jun 2025 10:15:30 GMT

Read the original announcement

advisoryUnratedOSV24 Oct 2026

Malicious code in hackgit1778554705 (RubyGems)

--- _-= Per source details. Do not edit below this line.=-_

Announced 7 Jul 2026

hackgit1778554705

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:MAL-2026-7730

hackgit1778554705

Source reference: /affected/0/package/name

Affected versions: 0.0.1
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Publisher severity

No explicit severity was provided.

Event: #6586 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:30:06 GMT
Publisher date: Tue, 07 Jul 2026 11:53:24 GMT

Read the original announcement

advisoryUnratedOSV24 Oct 2026

Malicious code in hgpathr3 (RubyGems)

--- _-= Per source details. Do not edit below this line.=-_

Announced 7 Jul 2026

hgpathr3

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:MAL-2026-7736

hgpathr3

Source reference: /affected/0/package/name

Affected versions: 0.0.1
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Publisher severity

No explicit severity was provided.

Event: #6585 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:30:06 GMT
Publisher date: Tue, 07 Jul 2026 11:53:28 GMT

Read the original announcement

advisoryUnratedOSV24 Oct 2026

Malicious code in hraq2 (RubyGems)

--- _-= Per source details. Do not edit below this line.=-_

Announced 7 Jul 2026

hraq2

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:MAL-2026-7764

hraq2

Source reference: /affected/0/package/name

Affected versions: 0.0.1
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Publisher severity

No explicit severity was provided.

Event: #6584 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:30:05 GMT
Publisher date: Tue, 07 Jul 2026 11:53:45 GMT

Read the original announcement

advisoryUnratedOSV24 Oct 2026

Malicious code in gtest1778553445 (RubyGems)

--- _-= Per source details. Do not edit below this line.=-_

Announced 7 Jul 2026

gtest1778553445

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:MAL-2026-7726

gtest1778553445

Source reference: /affected/0/package/name

Affected versions: 0.0.1
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Publisher severity

No explicit severity was provided.

Event: #6583 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:30:04 GMT
Publisher date: Tue, 07 Jul 2026 11:53:22 GMT

Read the original announcement

advisoryUnratedOSV24 Oct 2026

Malicious code in proxyta14c1bf1 (RubyGems)

--- _-= Per source details. Do not edit below this line.=-_

Announced 7 Jul 2026

proxyta14c1bf1

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:MAL-2026-8446

proxyta14c1bf1

Source reference: /affected/0/package/name

Affected versions: 0.0.1
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Publisher severity

No explicit severity was provided.

Event: #6582 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:30:04 GMT
Publisher date: Tue, 07 Jul 2026 12:00:36 GMT

Read the original announcement

advisoryUnratedOSV24 Oct 2026

Malicious code in resolvrtest (RubyGems)

--- _-= Per source details. Do not edit below this line.=-_

Announced 18 Mar 2026

resolvrtest

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:MAL-2026-1921

resolvrtest

Source reference: /affected/0/package/name

Affected versions: 0.0.3
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Publisher severity

No explicit severity was provided.

Event: #6581 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:30:03 GMT
Publisher date: Wed, 18 Mar 2026 12:21:56 GMT

Read the original announcement

advisoryUnratedOSV24 Oct 2026

Malicious code in rack_envinspector (RubyGems)

--- _-= Per source details. Do not edit below this line.=-_

Announced 25 Jun 2024

rack_envinspector

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:MAL-2024-7007

rack_envinspector

Source reference: /affected/0/package/name

Affected versions: 0.1
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Publisher severity

No explicit severity was provided.

Event: #6580 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:30:02 GMT
Publisher date: Tue, 25 Jun 2024 13:52:01 GMT

Read the original announcement

advisoryUnratedOSV24 Oct 2026

Malicious code in qagwpyrinwn (RubyGems)

--- _-= Per source details. Do not edit below this line.=-_

Announced 7 Jul 2026

qagwpyrinwn

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:MAL-2026-8494

qagwpyrinwn

Source reference: /affected/0/package/name

Affected versions: 0.0.1
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Publisher severity

No explicit severity was provided.

Event: #6579 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:30:02 GMT
Publisher date: Tue, 07 Jul 2026 12:01:01 GMT

Read the original announcement

advisoryUnratedOSV24 Oct 2026

Malicious code in queenbee-plugin (RubyGems)

--- _-= Per source details. Do not edit below this line.=-_ ## Source: ossf-package-analysis (705c314b786f674b8b06825a6211d1595db25022404041a4d8760b4094e863e1) The OpenSSF Package Analysis project identified 'queenbee-plugin' @ 99.0.7 (rubygems) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - The package executes one or more commands associated with malicious behavior.

Announced 23 Dec 2025

queenbee-plugin

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:MAL-2025-192914

queenbee-plugin

Source reference: /affected/0/package/name

Affected versions: 90002.0
Source reference: /affected/0/versions
99.0.7
Source reference: /affected/0/versions
99.0.6
Source reference: /affected/0/versions
99.0.4
Source reference: /affected/0/versions
99.0.1
Source reference: /affected/0/versions
99.0.0
Source reference: /affected/0/versions
99.0.3
Source reference: /affected/0/versions
99.0.5
Source reference: /affected/0/versions
99.0.8
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Publisher severity

No explicit severity was provided.

Event: #6578 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:30:01 GMT
Publisher date: Tue, 23 Dec 2025 08:41:05 GMT

Read the original announcement

advisoryUnratedOSV24 Oct 2026

Malicious code in proxyta4d404a4 (RubyGems)

--- _-= Per source details. Do not edit below this line.=-_

Announced 7 Jul 2026

proxyta4d404a4

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:MAL-2026-8447

proxyta4d404a4

Source reference: /affected/0/package/name

Affected versions: 0.0.1
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Publisher severity

No explicit severity was provided.

Event: #6577 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:30:00 GMT
Publisher date: Tue, 07 Jul 2026 12:00:37 GMT

Read the original announcement

advisoryUnratedOSV24 Oct 2026

Malicious code in referral-candy (RubyGems)

--- _-= Per source details. Do not edit below this line.=-_

Announced 25 Jun 2024

referral-candy

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:MAL-2024-7011

referral-candy

Source reference: /affected/0/package/name

Affected versions: 0.1.0
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Publisher severity

No explicit severity was provided.

Event: #6576 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:29:59 GMT
Publisher date: Tue, 25 Jun 2024 13:52:03 GMT

Read the original announcement

advisoryUnratedOSV24 Oct 2026

Malicious code in proxyt8c6730c3 (RubyGems)

--- _-= Per source details. Do not edit below this line.=-_

Announced 7 Jul 2026

proxyt8c6730c3

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:MAL-2026-8445

proxyt8c6730c3

Source reference: /affected/0/package/name

Affected versions: 0.0.1
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Publisher severity

No explicit severity was provided.

Event: #6575 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:29:59 GMT
Publisher date: Tue, 07 Jul 2026 12:00:36 GMT

Read the original announcement

advisoryUnratedOSV24 Oct 2026

Malicious code in proxytceffa3ec (RubyGems)

--- _-= Per source details. Do not edit below this line.=-_

Announced 7 Jul 2026

proxytceffa3ec

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:MAL-2026-8448

proxytceffa3ec

Source reference: /affected/0/package/name

Affected versions: 0.0.1
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Publisher severity

No explicit severity was provided.

Event: #6574 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:29:58 GMT
Publisher date: Tue, 07 Jul 2026 12:00:38 GMT

Read the original announcement

advisoryUnratedOSV24 Oct 2026

Malicious code in lita_onewheel-beer-tin-bucket (RubyGems)

--- _-= Per source details. Do not edit below this line.=-_

Announced 25 Jun 2024

lita_onewheel-beer-tin-bucket

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:MAL-2024-6968

lita_onewheel-beer-tin-bucket

Source reference: /affected/0/package/name

Affected versions: 0.1.3
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Publisher severity

No explicit severity was provided.

Event: #6573 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:29:58 GMT
Publisher date: Tue, 25 Jun 2024 13:51:36 GMT

Read the original announcement

advisoryUnratedOSV24 Oct 2026

Malicious code in qagzskimfsb (RubyGems)

--- _-= Per source details. Do not edit below this line.=-_

Announced 7 Jul 2026

qagzskimfsb

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:MAL-2026-8495

qagzskimfsb

Source reference: /affected/0/package/name

Affected versions: 0.0.1
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Publisher severity

No explicit severity was provided.

Event: #6572 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:29:57 GMT
Publisher date: Tue, 07 Jul 2026 12:01:01 GMT

Read the original announcement

advisoryUnratedOSV24 Oct 2026

Malicious code in lita_onewheel-beer-abvpub (RubyGems)

--- _-= Per source details. Do not edit below this line.=-_

Announced 25 Jun 2024

lita_onewheel-beer-abvpub

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:MAL-2024-6959

lita_onewheel-beer-abvpub

Source reference: /affected/0/package/name

Affected versions: 0.0.1
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Publisher severity

No explicit severity was provided.

Event: #6571 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:29:56 GMT
Publisher date: Tue, 25 Jun 2024 13:51:30 GMT

Read the original announcement

advisoryUnratedOSV24 Oct 2026

Malicious code in lita_onewheel-beer-craftpourhouse (RubyGems)

--- _-= Per source details. Do not edit below this line.=-_

Announced 25 Jun 2024

lita_onewheel-beer-craftpourhouse

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:MAL-2024-6964

lita_onewheel-beer-craftpourhouse

Source reference: /affected/0/package/name

Affected versions: 1.0.0
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Publisher severity

No explicit severity was provided.

Event: #6570 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 22:29:56 GMT
Publisher date: Tue, 25 Jun 2024 13:51:34 GMT

Read the original announcement

Older events