The active-admin_import RubyGems package at version 4.2.0 is flagged as malicious by the OpenSSF malicious packages database (MAL-2024-6393). This indicates that the package contains embedded malicious code, posing a risk to users who install or use this version. There is no CVSS score or detailed vulnerability description available, and no known exploits in the wild have been reported. The threat is cataloged under the GHSA advisory GHSA-rqph-8fpx-36p8 and is tracked in the GCVE database.

Use of the active-admin_import package version 4.2.0 may result in execution of malicious code, which could compromise the security of the environment where it is installed. The exact impact depends on the malicious payload but generally includes risks such as unauthorized access, data compromise, or system integrity violations. No confirmed exploitation in the wild has been reported to date.

No official patch or remediation is currently documented. Users should avoid using active-admin_import version 4.2.0 and remove it from their environments if present. Monitor the vendor or RubyGems advisories for updates or fixed versions. Since this is a malicious package, replacing it with a trusted, verified version or alternative is recommended. Patch status is not yet confirmed — check the vendor advisory or RubyGems security notices for current remediation guidance.