The font_awesome-sass RubyGems package version 5.12.0 has been identified as containing malicious code. This was reported by the OpenSSF malicious packages project and cataloged under MAL-2024-6914 and GHSA-q39v-hwg9-cfg6. There is no CVSS score or detailed technical exploit information available. The threat is specific to the exact version 5.12.0 of the package. No known exploits in the wild have been reported at this time.

Using the compromised font_awesome-sass version 5.12.0 package may introduce malicious code into dependent projects, potentially leading to unauthorized actions or compromise of the environment where the package is used. The exact impact is not detailed, but supply chain malware can lead to code execution or data compromise depending on the malicious payload.

No official patch or remediation guidance is provided. Users should avoid using font_awesome-sass version 5.12.0 and instead use a different, verified safe version of the package. Since this is a malicious package incident, removing the affected version from projects and replacing it with a clean version is recommended. Monitor official RubyGems and OpenSSF advisories for updates.