The assembla-cli RubyGem version 0.0.2 has been identified as containing malicious code by the OpenSSF malicious packages initiative. This is a case of a malicious package rather than a software vulnerability with a known exploit or CVSS score. No patch or remediation has been published, and no known exploits in the wild have been reported. The threat is cataloged under MAL-2024-6694 and GHSA-rm34-xw85-73x8. The affected ecosystem is RubyGems, and the issue is limited to version 0.0.2 of assembla-cli.

Use of the assembla-cli RubyGem version 0.0.2 may result in execution of malicious code embedded within the package. This can lead to compromise of systems where this package is installed. No specific exploit details or impact scenarios are provided, but the presence of malicious code indicates a high risk to affected users.

Avoid using assembla-cli version 0.0.2. Since no patch or fixed version is indicated, users should remove this version from their environments and source dependencies from trusted and verified packages. Monitor official RubyGems and OpenSSF advisories for updates or safer versions. There is no vendor advisory or official fix available at this time.