MalwarePublished 4 Nov 2026

w002yardprobe (RubyGems) · Malicious Code

Affects w002yardprobeSource GCVE Database

Malicious package : remove w002yardprobe and rotate any secrets on hosts that installed it.

Data as of 4 Nov 2026, 04:28 UTC

Classification

Malicious package

Published to RubyGems · OSV MAL-2026-18599

What to do

Remove w002yardprobe from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
RubyGemsw002yardprobe	Affected =0.0.4 =0.0.5	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The w002yardprobe RubyGem contains malicious code that executes during YARD documentation generation. It runs a script that collects host identifiers and exfiltrates them to a third-party URL. The script also modifies files in the build environment and leaves sentinel files indicating its activity. The malicious behavior triggers when documentation is generated, affecting developer workstations, CI runners, or documentation hosting services that process the gem's docs.

Impact

The malicious script exfiltrates sensitive host environment information to an external third-party server, potentially compromising confidentiality of build or developer environments. It also alters files in the build environment, which could interfere with build integrity or detection. The impact is limited to environments that generate documentation for this gem, including developer machines, CI pipelines, and documentation hosting services.

Defensive guidance

Avoid generating documentation for the affected gem versions 0.0.4 and 0.0.5. Remove or do not use these gem versions. Monitor and restrict network egress to prevent unauthorized data exfiltration. Consider scanning for the presence of the sentinel files (W002SCRIPT_RAN.txt and W002EGRESS_OK.txt) as indicators of compromise.

Summary

The w002yardprobe RubyGem versions 0.0.4 and 0.0.5 include a .yardopts file that loads and executes a script (script.rb) during YARD documentation generation. This script collects host information such as hostname, current directory, UID, and Ruby version, then sends this data via HTTP POST to a hardcoded external collector URL. Additionally, the script modifies the gem's source file by inserting a runtime timestamp and creates sentinel files in the build directory to mark its execution. The malicious code activates specifically during documentation generation rather than installation or runtime requiring, targeting environments that generate or host documentation.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 4 Nov 2026, 04:28 UTC

Technical details

References

Community reviews