The catarse-paypal_express RubyGems package version 3.0.2 has been flagged as containing malicious code according to the OpenSSF malicious packages repository (MAL-2024-6822). This indicates that the package itself is a vector for malicious activity, potentially impacting any software projects that depend on this specific version. There is no CVSS score or detailed technical exploit information provided, and no known exploits in the wild have been reported. The threat is categorized as a malicious package rather than a traditional vulnerability.

Use of catarse-paypal_express version 3.0.2 may lead to execution of malicious code within applications that include this package, potentially compromising system integrity, confidentiality, or availability depending on the payload. The exact impact is not detailed, but supply chain compromises can lead to broad security risks for dependent projects.

No official patch or remediation link is provided. Users should avoid using catarse-paypal_express version 3.0.2 and remove it from their dependency trees. Replace it with a trusted alternative or a version verified to be clean once available. Monitor vendor or repository advisories for updates. Since this is not a cloud service, remediation depends on user action.