Malicious Code Detected in monolith-twirp-scribe-scribe Package
Summary
MAL-2026-2264: Malicious code in monolith-twirp-scribe-scribe (RubyGems). Affects monolith-twirp-scribe-scribe versions 1.0.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'monolith-twirp-scribe-scribe' package is a RubyGem that facilitates communication in applications using the Twirp framework. It is designed to streamline the process of creating and managing RPC (Remote Procedure Call) services. However, version 1.0.6 of this package has been identified as malicious, posing a significant risk to users and their applications.
Vulnerability Detail
The vulnerability stems from the package's communication with a domain linked to malicious activities. This behavior can lead to unauthorized data access, potential data breaches, and exploitation of the affected systems. The malicious nature of the package was identified by the OpenSSF Package Analysis project, which flagged it for its harmful interactions.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
bundle remove monolith-twirp-scribe-scribeIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds available for this vulnerability. The best course of action is to remove the affected package from your application entirely.
Conclusion
The 'monolith-twirp-scribe-scribe' package has been flagged for malicious activity, posing a risk to applications that utilize it. Users are advised to remove the package and monitor for any updates regarding a secure version. Utilizing tools like Vulert can help in identifying and managing vulnerabilities in your software.
See every vulnerability recorded for monolith-twirp-scribe-scribe →
FAQ
The vulnerability involves the package communicating with a domain associated with malicious activities, which can compromise the security of applications using it.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities without needing to install any software.
As of now, there is no patched version available. It is recommended to remove the package until a secure version is released.
You should remove the 'monolith-twirp-scribe-scribe' package from your project and monitor for updates regarding a secure version.
You can use tools like Vulert to monitor your dependencies for vulnerabilities in real-time, ensuring you are alerted to any issues as they arise.
