omniauth_marvin (RubyGems) · Malicious Code
Affects omniauth_marvinSource GCVE Database
Rated by Threat Radar
Data as of 18 Jul 2026, 22:38 UTC
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
RubyGemsomniauth_marvinpkg:gem/omniauth_marvinOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Avoid using omniauth_marvin version 1.1.0. Since this is a malicious package, the best mitigation is to remove or not install this version. Users should verify package authenticity and source before installation. Monitor vendor or ecosystem advisories for updates or removal from repositories.
Description
The RubyGems package omniauth_marvin version 1.1.0 contains malicious code as identified by the OpenSSF malicious packages project. This package is flagged as a malicious package rather than a traditional vulnerability. No CVSS score or detailed technical exploitation information is provided.