MalwarePublished 25 Jun 2024Updated 18 Jul 2026

asset-symlink (RubyGems) · Malicious Code

Affects asset-symlinkSource GCVE Database

Malicious package : remove asset-symlink and rotate any secrets on hosts that installed it.

Data as of 19 Jul 2026, 00:56 UTC

Classification

Malicious package

Published to RubyGems · OSV MAL-2024-6703

What to do

Remove asset-symlink from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
RubyGemsasset-symlink`pkg:gem/asset-symlink`Other threats	Affected =0.3.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The RubyGems package 'asset-symlink' version 0.3.1 contains malicious code. This issue is identified as a malicious package rather than a traditional vulnerability. There is no CVSS score or detailed technical exploit information available. No known exploits in the wild have been reported. No patch or remediation guidance is provided in the available data.

Impact

Users who install or use the 'asset-symlink' RubyGem version 0.3.1 may be exposed to malicious code execution or other malicious activities embedded within the package. The exact impact is not detailed, but malicious packages typically risk system compromise, data theft, or unauthorized actions performed by the attacker.

Defensive guidance

Users should avoid installing or using the 'asset-symlink' RubyGem version 0.3.1. It is recommended to verify the integrity and trustworthiness of RubyGems before installation and to remove the package if already installed. Monitor official RubyGems advisories or the OpenSSF database for updates or remediation information.

Summary

The package 'asset-symlink' version 0.3.1 in the RubyGems ecosystem has been identified as containing malicious code. This classification comes from the OpenSSF malicious packages database and is tracked under MAL-2024-6703 and GHSA-5f9m-8vx3-v2x5. The nature of the threat is that the package itself is malicious, which can pose risks to users who install or use it.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 19 Jul 2026, 00:56 UTC

Technical details

References

Community reviews