The prometheus_client_ruby package for RubyGems includes malicious code in the specified versions. This was detected and cataloged by the OpenSSF as a malicious package (MAL-2025-192912). No further technical details or exploit methods are described. No patch or fix links are provided, and the package is not a cloud service. The threat is identified as a supply chain risk due to the presence of malicious code in the package versions listed.

Use of the affected prometheus_client_ruby package versions may result in the introduction of malicious code into dependent projects. This can lead to compromise of systems using these versions, depending on the nature of the malicious code. No specific exploitation in the wild has been reported to date.

Patch status is not yet confirmed — check the vendor advisory or RubyGems repository for current remediation guidance. Users should avoid using the affected versions and verify the integrity of the prometheus_client_ruby package before use. Consider removing or replacing the package until a clean version is available.