MalwarePublished 7 Jul 2026Updated 24 Sep 2026

swcalcald (RubyGems) · Malicious Code

Affects swcalcaldSource GCVE Database

Malicious package : remove swcalcald and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:07 UTC

Classification

Malicious package

Published to RubyGems · OSV MAL-2026-8924

What to do

Remove swcalcald from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
RubyGemsswcalcald`pkg:gem/swcalcald`Other threats	Affected =0.0.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The RubyGems package 'swcalcald' version 0.0.1 contains malicious code as identified by the OpenSSF project. This package is classified as a malicious package rather than a traditional vulnerability with a patch. There are no known exploits in the wild reported. No official patch or remediation guidance is available from the vendor or authoritative sources.

Impact

Use of the 'swcalcald' package version 0.0.1 may lead to execution of malicious code embedded within the package. This can compromise the security of systems that install or run this package. No specific exploitation details or impact scenarios are documented, and no known exploits in the wild have been reported.

Defensive guidance

Since this is a malicious package rather than a vulnerability with a patch, remediation involves avoiding installation or use of 'swcalcald' version 0.0.1. Users should remove this package if already installed and verify dependencies to ensure it is not included transitively. Monitor trusted sources such as RubyGems and OpenSSF for updates or removal notices.

Summary

The 'swcalcald' RubyGems package at version 0.0.1 has been identified as containing malicious code by the OpenSSF malicious packages database (MAL-2026-8924). This is a case of a malicious package rather than a vulnerability arising from a coding error or design flaw. The package is flagged in the RubyGems ecosystem and is known under the alias GHSA-7gpq-qch7-jw9x.

References

github.com/advisories/GHSA-7gpq-qch7-jw9x (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 18 Jul 2026, 21:29 UTC

Technical details

References

Community reviews