MalwarePublished 13 May 2026Updated 18 Jul 2026

knot-rack-session-store (RubyGems) · Malicious Code

Affects knot-rack-session-storeSource GCVE Database

Malicious package : remove knot-rack-session-store and rotate any secrets on hosts that installed it.

Data as of 18 Jul 2026, 23:50 UTC

Classification

Malicious package

Published to RubyGems · OSV MAL-2026-3633

What to do

Remove knot-rack-session-store from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
RubyGemsknot-rack-session-store	Affected =1.0.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The knot-rack-session-store RubyGem version 1.0.2 is identified as a malicious package. It is part of the Go BufferZoneCorp and RubyGems knot-theory clusters known for malicious activity. This package steals credentials, establishes unauthorized SSH access, and tampers with build and workflow environment variables. No official patch or remediation guidance is provided in the available data.

Impact

If used, this malicious package can compromise system security by stealing sensitive credentials, enabling unauthorized SSH access, and altering environment variables critical to build and workflow processes. This can lead to unauthorized access, data exfiltration, and potential disruption or compromise of development pipelines.

Defensive guidance

Users should immediately remove version 1.0.2 of knot-rack-session-store from their environments and avoid using this package. Verify dependencies and supply chain integrity to ensure no malicious versions are present. Monitor for any unauthorized SSH keys or environment changes that may have been introduced. Check vendor or security advisories for updates or further guidance.

Summary

The knot-rack-session-store package version 1.0.2 is a malicious RubyGem that belongs to a cluster of malicious packages targeting RubyGems and Go BufferZoneCorp ecosystems. Its malicious behavior includes credential theft, unauthorized SSH access setup, and manipulation of build and workflow environment variables. This package is flagged by multiple security sources including OpenSSF and Google Open Source Security. There is no CVSS score or vendor advisory indicating a patch or fix. The package is not a cloud service, and no known exploits in the wild have been reported.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 18 Jul 2026, 23:50 UTC

Technical details

References

Community reviews