The sprox-c160-4git RubyGems package at version 0.0.1 has been flagged as containing malicious code by the OpenSSF malicious packages database. This is cataloged under MAL-2026-8886 and GHSA-mvq8-86w6-929w. There is no detailed technical vulnerability description or exploit method provided, and no known exploits in the wild have been reported. The package is considered a supply chain threat due to its malicious nature.

Using the malicious sprox-c160-4git package version 0.0.1 could lead to compromise of systems or data depending on the malicious payload embedded in the package. Specific impacts are not detailed in the source data. No known active exploitation has been reported.

Since this is a malicious package, the primary mitigation is to avoid using sprox-c160-4git version 0.0.1. No patch or official fix is available. Users should remove this package from their environments if present and verify dependencies to ensure no indirect inclusion. Monitor trusted sources for any updates or advisories regarding this package.