{"schema_version":"1","data":[{"id":6578,"advisory_id":"7f26d737-d3da-4608-a972-ddcaedd5d2bf","revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MAL-2025-192914","source_published_at":"2025-12-23T08:41:05+00:00","published_at":"2026-10-24T22:30:01.328873+00:00","extraction_method":"structured","technologies":["core-osv","queenbee-plugin"],"cve_ids":[],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Malicious code in queenbee-plugin (RubyGems)","summary":"--- _-= Per source details. Do not edit below this line.=-_ ## Source: ossf-package-analysis (705c314b786f674b8b06825a6211d1595db25022404041a4d8760b4094e863e1) The OpenSSF Package Analysis project identified 'queenbee-plugin' @ 99.0.7 (rubygems) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - The package executes one or more commands associated with malicious behavior.","evidence":"osv:MAL-2025-192914","products":[{"name":{"value":"queenbee-plugin","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"90002.0","evidence":"/affected/0/versions"},{"value":"99.0.7","evidence":"/affected/0/versions"},{"value":"99.0.6","evidence":"/affected/0/versions"},{"value":"99.0.4","evidence":"/affected/0/versions"},{"value":"99.0.1","evidence":"/affected/0/versions"},{"value":"99.0.0","evidence":"/affected/0/versions"},{"value":"99.0.3","evidence":"/affected/0/versions"},{"value":"99.0.5","evidence":"/affected/0/versions"},{"value":"99.0.8","evidence":"/affected/0/versions"}]}],"severity":"unknown","structured":{"id":"MAL-2025-192914","aliases":["GHSA-v7j5-ccf7-5prj","MAL-2025-192914"],"affected":[{"package":{"name":"queenbee-plugin","purl":"pkg:gem/queenbee-plugin","ecosystem":"RubyGems"},"versions":["90002.0","99.0.7","99.0.6","99.0.4","99.0.1","99.0.0","99.0.3","99.0.5","99.0.8"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/queenbee-plugin/MAL-2025-192914.json"}}],"modified":"2026-09-24T09:01:25.959917517Z","provider":"osv","references":["https://github.com/advisories/GHSA-v7j5-ccf7-5prj"],"provider_metadata":{"malicious-packages-origins":[{"id":"RLMA-2025-06624","sha256":"d90da20fcb1e0c7e7aca86ec48a7866d2263fe80dd2698b692fe426ae4de8382","source":"reversing-labs","versions":["90002.0"],"import_time":"2025-12-24T10:07:32.626473417Z","modified_time":"2025-12-23T08:41:05Z"},{"sha256":"705c314b786f674b8b06825a6211d1595db25022404041a4d8760b4094e863e1","source":"ossf-package-analysis","versions":["99.0.7"],"import_time":"2026-03-27T12:50:13.240462073Z","modified_time":"2026-03-27T12:40:43Z"},{"id":"RLUA-2026-02090","sha256":"cd8daaa01f0acf4635ceb03645a039723dca0f1c74a1f3b56023a29b8a146637","source":"reversing-labs","versions":["99.0.6","99.0.4","99.0.1","99.0.7","99.0.0","99.0.3","99.0.5","99.0.8"],"import_time":"2026-04-16T15:39:36.950312136Z","modified_time":"2026-04-16T10:28:48Z"},{"id":"RLUA-2026-09023","sha256":"d75b179a8de7af2c08d657ce83f465690265e835c91b3920d4ca344fe63e0be2","source":"reversing-labs","import_time":"2026-09-24T08:48:42.054321827Z","modified_time":"2026-09-22T16:37:52Z"}]}},"related_cves":[],"security_relevant":true,"severity_evidence":null},"priority":{"reasons":[],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"context_update":false}],"next_after":6578,"next_before":6578}