Malicious Code Detected in kerokwis Package - RubyGems Vulnerability
Summary
MAL-2026-16420: Malicious code in kerokwis (RubyGems). Affects kerokwis versions 99. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The kerokwis package is a RubyGem that serves specific functionalities within Ruby applications. However, it has been flagged for malicious behavior, particularly due to its communication with a domain linked to malicious activities. This raises concerns about the security and integrity of applications utilizing this package.
Vulnerability Detail
The vulnerability in the kerokwis package arises from its ability to communicate with a domain associated with malicious activities. This could lead to data breaches, unauthorized access, or the execution of harmful code within applications that depend on this package. The identification of this vulnerability was made by the OpenSSF Package Analysis project, which highlighted the potential risks posed by the package's behavior.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
bundle remove kerokwisIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider removing the kerokwis package from your application until a safe version is released. You can do this by executing:
gem uninstall kerokwis
This will help mitigate any immediate risks associated with the malicious behavior of the package.
Conclusion
The kerokwis package has been identified as malicious due to its communication with a harmful domain. It is crucial for developers using this package to take immediate action by updating or uninstalling it to protect their applications from potential threats.
See every vulnerability recorded for kerokwis →
FAQ
The kerokwis package is a RubyGem used in Ruby applications, but it has been flagged for malicious behavior.
The vulnerability was identified by the OpenSSF Package Analysis project, which monitors and analyzes packages for malicious activities.
Using the kerokwis package can expose your application to data breaches, unauthorized access, and execution of harmful code.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software using just a manifest file like package-lock.json. Visit Vulert Scanner to check your application without needing to sign up.
If immediate updates are not possible, consider uninstalling the kerokwis package as a temporary measure to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for kerokwis.
