MalwarePublished 25 Jun 2024Updated 18 Jul 2026

gemnasium-gitlab-service (RubyGems) · Malicious Code

Affects gemnasium-gitlab-serviceSource GCVE Database

Malicious package : remove gemnasium-gitlab-service and rotate any secrets on hosts that installed it.

Data as of 19 Jul 2026, 00:06 UTC

Classification

Malicious package

Published to RubyGems · OSV MAL-2024-6929

What to do

Remove gemnasium-gitlab-service from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
RubyGemsgemnasium-gitlab-service`pkg:gem/gemnasium-gitlab-service`Other threats	Affected =0.3.0 =0.2.1 =0.6.0 =7.0.3 =0.2.5 =0.1.0 =0.2.2 =0.1.2 =0.2.6 =7.0.0 =0.2.4 =0.2.3 =0.1.1 =7.0.1 =6.0.7 =8.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The gemnasium-gitlab-service RubyGem contains malicious code in multiple specific versions. This is a supply chain threat where the package itself is compromised to potentially perform unauthorized or harmful actions when used. No CVSS score or detailed technical exploitation information is provided.

Impact

Using any of the affected versions of gemnasium-gitlab-service may result in the execution of malicious code, which could compromise the security and integrity of systems that incorporate this package. The exact impact depends on the malicious payload but generally includes risks such as unauthorized access, data leakage, or system manipulation.

Defensive guidance

Users should avoid using the affected versions of gemnasium-gitlab-service listed and remove or replace them with trusted alternatives. Monitor vendor advisories or the RubyGems repository for updates or clean versions. Since this is not a cloud service, remediation depends on user action.

Summary

The gemnasium-gitlab-service package in the RubyGems ecosystem has been identified as containing malicious code in several discrete versions. This classification comes from the OpenSSF malicious packages database and is tracked under MAL-2024-6929 and GHSA-wggv-fp48-h6pm. The affected versions are explicitly enumerated, indicating that these specific releases are compromised.

References

github.com/advisories/GHSA-wggv-fp48-h6pm (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 19 Jul 2026, 00:06 UTC

Technical details

References

Community reviews