MalwarePublished 25 Jun 2024Updated 18 Jul 2026

bitmovin_api (RubyGems) · Malicious Code

Affects bitmovin_apiSource GCVE Database

Malicious package : remove bitmovin_api and rotate any secrets on hosts that installed it.

Data as of 19 Jul 2026, 00:48 UTC

Classification

Malicious package

Published to RubyGems · OSV MAL-2024-6782

What to do

Remove bitmovin_api from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
RubyGemsbitmovin_api`pkg:gem/bitmovin_api`Other threats	Affected =0.0.4	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The RubyGem package 'bitmovin_api' version 0.0.4 contains malicious code as identified by the OpenSSF malicious packages project. This is a supply chain threat where the package itself is intentionally harmful. No official patch or remediation guidance is currently provided.

Impact

Users who install or use 'bitmovin_api' version 0.0.4 may be exposed to malicious code execution, potentially compromising their systems or data. The exact impact depends on the nature of the malicious code, which is not detailed in the provided data. No known active exploitation has been reported so far.

Defensive guidance

Users should avoid using 'bitmovin_api' version 0.0.4 and remove it from their environments if present. Monitor the vendor or RubyGems advisories for updates or official fixes. Since this is a malicious package, replacing it with a trusted alternative or verifying package integrity before installation is recommended.

Summary

The 'bitmovin_api' RubyGem version 0.0.4 has been flagged as containing malicious code by the OpenSSF malicious packages initiative. This indicates that the package was published with intentionally harmful content, posing a risk to users who install or use this version. There is no CVSS score or detailed technical vulnerability description available. No known exploits in the wild have been reported. The threat is specific to the RubyGems ecosystem and affects exactly version 0.0.4 of the package.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 19 Jul 2026, 00:48 UTC

Technical details

References

Community reviews