MalwarePublished 25 Jun 2024Updated 18 Jul 2026

bosh_plugin-pipeline (RubyGems) · Malicious Code

Affects bosh_plugin-pipelineSource GCVE Database

Malicious package : remove bosh_plugin-pipeline and rotate any secrets on hosts that installed it.

Data as of 19 Jul 2026, 00:47 UTC

Classification

Malicious package

Published to RubyGems · OSV MAL-2024-6791

What to do

Remove bosh_plugin-pipeline from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
RubyGemsbosh_plugin-pipeline`pkg:gem/bosh_plugin-pipeline`Other threats	Affected =0.2.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The RubyGems package 'bosh_plugin-pipeline' version 0.2.1 contains malicious code as identified by the OpenSSF malicious packages project. This is a supply chain threat involving a malicious package published to the RubyGems ecosystem. No CVSS score is provided, and there are no known exploits in the wild at this time.

Impact

Use of the affected version 0.2.1 of 'bosh_plugin-pipeline' may result in execution of malicious code embedded in the package. This could compromise the security of systems that install or run this package. No specific exploit details or impact scenarios are provided, and no known active exploitation has been reported.

Defensive guidance

Users should avoid using version 0.2.1 of 'bosh_plugin-pipeline'. If already installed, remove the package and consider auditing systems for any suspicious activity. Monitor official sources for updates or patches addressing this malicious package.

Summary

The 'bosh_plugin-pipeline' RubyGems package version 0.2.1 has been identified as containing malicious code. This classification comes from the OpenSSF malicious packages repository and is tracked under MAL-2024-6791 and GHSA-2wpw-f7g9-hv56. The package is flagged as a supply chain threat due to the presence of malicious content within the package itself. There is no detailed technical description of the malicious behavior or impact, nor is there a vendor advisory or patch information available.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 19 Jul 2026, 00:47 UTC

Technical details

References

Community reviews