The 'cucumber-rake_runner' RubyGems package at version 0.0.3 is confirmed to contain malicious code, as reported by the OpenSSF malicious packages repository and tracked under MAL-2024-6845. This is a supply chain threat where the package itself is intentionally harmful. There is no CVSS score or detailed technical exploit information available. No known exploits in the wild have been reported, and no vendor advisory or patch information is provided.

Use of this package version may lead to execution of malicious code within environments that install or run it. This poses a risk to the integrity and security of systems depending on this package. Since it is a malicious package, the impact is potentially severe depending on the payload and context of use, but specific impact details are not disclosed.

Avoid using the 'cucumber-rake_runner' package version 0.0.3. Since no patch or fixed version is provided, the recommended action is to remove this package from your dependencies and replace it with a trusted alternative. Monitor official RubyGems and OpenSSF advisories for updates or remediation guidance.