VulnerabilityPublished 25 Jun 2024Updated 18 Jul 2026

candy-check (RubyGems) · Malicious Code

Affects candy-checkSource GCVE Database

Severity

High

Rated by Threat Radar

Data as of 19 Jul 2026, 00:46 UTC

What to do

Affected software

Product	Affected	Fixed in
RubyGemscandy-check`pkg:gem/candy-check`Other threats	Affected =0.2.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Avoid using the 'candy-check' package version 0.2.1. Monitor vendor or repository advisories for updates or remediation guidance.

Description

The RubyGems package 'candy-check' version 0.2.1 contains malicious code as identified by the OpenSSF malicious packages project. This is a supply chain threat involving a malicious package published to the RubyGems ecosystem. No CVSS score is assigned to this threat.

Impact

Use of the malicious 'candy-check' version 0.2.1 package could lead to compromise of systems or data depending on the malicious code's behavior. However, no specific impact details or exploitation reports are available at this time.

Summary

The 'candy-check' RubyGems package at version 0.2.1 has been identified as containing malicious code. This classification comes from the OpenSSF malicious packages repository and is tracked under MAL-2024-6802 and GHSA-m3r2-54xx-grg7. There is no detailed technical description or exploit information available. The package is not a cloud service, and no known exploits in the wild have been reported.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 19 Jul 2026, 00:46 UTC

Technical details

References

Community reviews