MalwarePublished 7 Jul 2026Updated 24 Sep 2026

wpact (RubyGems) · Malicious Code

Affects wpactSource GCVE Database

Malicious package : remove wpact and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:07 UTC

Classification

Malicious package

Published to RubyGems · OSV MAL-2026-9434

What to do

Remove wpact from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
RubyGemswpact`pkg:gem/wpact`Other threats	Affected =0.0.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The RubyGems package 'wpact' version 0.0.1 contains malicious code as identified by the OpenSSF malicious packages project. This is a supply chain threat involving a malicious package published to the RubyGems ecosystem. No official patch or remediation guidance is provided in the available data.

Impact

Use of the 'wpact' RubyGems package version 0.0.1 may lead to execution of malicious code within environments that install or run this package. The exact impact is not detailed, but typically malicious packages can lead to compromise of systems, data exfiltration, or further malware deployment. No known exploits in the wild have been reported.

Defensive guidance

The best mitigation is to avoid using the 'wpact' package version 0.0.1. Users should verify the integrity and provenance of RubyGems packages before installation and consider using trusted sources or mirrors. Monitor official advisories for updates or removal of the malicious package from repositories.

Summary

The 'wpact' RubyGems package at version 0.0.1 has been flagged as containing malicious code. This classification comes from the OpenSSF malicious packages repository and is cataloged under MAL-2026-9434 and GHSA-5wh6-hpq8-g952. The threat is specific to this single package version and represents a supply chain risk through a malicious package upload.

References

github.com/advisories/GHSA-5wh6-hpq8-g952 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 18 Jul 2026, 20:33 UTC

Technical details

References

Community reviews