Malicious code in queenbee-plugin (RubyGems)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: ossf-package-analysis (705c314b786f674b8b06825a6211d1595db25022404041a4d8760b4094e863e1) The OpenSSF Package Analysis project identified 'queenbee-plugin' @ 99.0.7 (rubygems) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - The package executes one or more commands associated with malicious behavior.
MAL-2025-192914
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2025-192914
queenbee-plugin
Source reference: /affected/0/package/name
- Affected versions
- 90002.0
Source reference:
/affected/0/versions99.0.7Source reference:
/affected/0/versions99.0.6Source reference:
/affected/0/versions99.0.4Source reference:
/affected/0/versions99.0.1Source reference:
/affected/0/versions99.0.0Source reference:
/affected/0/versions99.0.3Source reference:
/affected/0/versions99.0.5Source reference:
/affected/0/versions99.0.8Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"package": {
"name": "queenbee-plugin",
"purl": "pkg:gem/queenbee-plugin",
"ecosystem": "RubyGems"
},
"versions": [
"90002.0",
"99.0.7",
"99.0.6",
"99.0.4",
"99.0.1",
"99.0.0",
"99.0.3",
"99.0.5",
"99.0.8"
],
"database_specific": {
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/queenbee-plugin/MAL-2025-192914.json"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #6578 · Revision 1
- Added to Heist Feed
- Publisher date