Critical Malicious Code Vulnerability in plugin-gem-example Package
Summary
MAL-2026-2402: Malicious code in plugin-gem-example (RubyGems). Affects plugin-gem-example versions 100.9.9 – 99.99.99. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The plugin-gem-example package is a RubyGem designed to facilitate plugin development for Ruby applications. It provides developers with essential tools and libraries to create and manage plugins efficiently. However, this package has been identified as containing malicious code, posing significant risks to applications that utilize it.
Vulnerability Detail
The vulnerability stems from the inclusion of malicious code within the plugin-gem-example package. This code can compromise the security of applications that depend on it, potentially leading to unauthorized access, data breaches, or system manipulation. The malicious code was identified in versions 99.99.99 and 100.9.9, and it is crucial for developers to be aware of the risks associated with using this package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
bundle remove plugin-gem-exampleIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, developers can remove the plugin-gem-example package from their projects until a secure version is confirmed. This can be done using the command: 'gem uninstall plugin-gem-example'.
Conclusion
The plugin-gem-example package has been identified as containing malicious code, posing serious security risks to applications that utilize it. Developers are urged to update or remove the package to safeguard their applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for plugin-gem-example →
FAQ
The malicious code can lead to unauthorized access and potential data breaches in applications that use the package.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Versions 99.99.99 and 100.9.9 of the plugin-gem-example package are known to contain the malicious code.
Yes, you can temporarily uninstall the plugin-gem-example package until a secure version is released.
The vulnerability was reported by ReversingLabs, a cybersecurity firm specializing in threat detection.
