The 'galvinhsiu-active-cart' RubyGems package at version 0.0.20 is confirmed to contain malicious code as reported by the OpenSSF malicious packages project. This is a supply chain threat where the package itself is intentionally harmful. There is no detailed information on the exact behavior or exploitation methods of the malicious code. No CVSS score or severity rating is provided by the source data.

Using version 0.0.20 of the 'galvinhsiu-active-cart' package may expose users to malicious code execution risks inherent in the package. The specific impact is not detailed, but inclusion of malicious code in a dependency can lead to compromise of the application or environment where it is used.

Avoid using version 0.0.20 of the 'galvinhsiu-active-cart' package. Since no patch or remediation is indicated, users should remove or replace this package with a trusted alternative. Monitor official RubyGems advisories or OpenSSF updates for any future remediation or safe versions.