The 'aliyun_sdk-core' RubyGems package at version 0.1.5 has been flagged as containing malicious code by the OpenSSF malicious packages database. This indicates that the package itself is intentionally harmful or compromised, posing a risk to users who install or use this specific version. There is no detailed technical information or exploit data provided, and no known exploits in the wild have been reported. The threat is cataloged under MAL-2024-6586 and GHSA-jrhw-qpjg-f62x identifiers.

Users who install or use version 0.1.5 of the 'aliyun_sdk-core' RubyGems package may be exposed to malicious code execution or other harmful effects inherent to the malicious payload within the package. The exact impact is not detailed, but supply chain malicious packages typically risk system compromise, data theft, or unauthorized actions within the environment where the package is used.

Avoid using version 0.1.5 of the 'aliyun_sdk-core' RubyGems package. Since no patch or remediation is indicated, users should remove this version from their environments and source dependencies from trusted, verified packages. Monitor official RubyGems advisories or the package maintainer for updates or clean versions. No official fix or patch is currently documented; patch status is not yet confirmed — check the vendor advisory or RubyGems security notices for current remediation guidance.