The capistrano_telegram RubyGems package version 1.0.0 has been identified as containing malicious code by the OpenSSF malicious packages database (MAL-2024-6818). This is a supply chain threat involving a malicious package rather than a conventional software vulnerability. The package is flagged under the GHSA advisory GHSA-874g-gq93-656c. There is no CVSS score or detailed technical information about the nature of the malicious code or its impact. No official patch or remediation instructions are available from the vendor or repository.

Use of the capistrano_telegram package version 1.0.0 may result in execution of malicious code within the environment where it is installed. This can lead to compromise of the affected system or environment depending on the malicious payload. No specific exploit or impact details are provided, and no known exploits in the wild have been reported.

Since this is a malicious package, the primary mitigation is to avoid using capistrano_telegram version 1.0.0. Remove any existing installations of this package from your environment. Monitor for any updates or advisories from RubyGems or the package maintainers regarding remediation or replacement. Patch status is not yet confirmed — check the vendor advisory or RubyGems repository for current remediation guidance.