MalwarePublished 7 Jul 2026Updated 24 Sep 2026

zpx52483db (RubyGems) · Malicious Code

Affects zpx52483dbSource GCVE Database

Malicious package : remove zpx52483db and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:07 UTC

Classification

Malicious package

Published to RubyGems · OSV MAL-2026-9671

What to do

Remove zpx52483db from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
RubyGemszpx52483db`pkg:gem/zpx52483db`Other threats	Affected =0.0.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: ghsa-malware (626d1e220dea93518081eb523b58782a30bf3d1ab4787b0395049b1497c29159) --- Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/9fbb5fba02ba2f02395d3d2d43c31b2c482b7a9d/osv/malicious/rubygems/zpx52483db/MAL-2026-9671.json))

Impact

Use of the malicious package 'zpx52483db' version 0.0.1 could lead to compromise of systems or data depending on the malicious code embedded. However, no specific impact details or exploitation reports are available. The presence of malicious code in a package repository poses a risk to developers and environments that install or depend on this package.

Defensive guidance

Avoid using the 'zpx52483db' package version 0.0.1. Monitor official RubyGems advisories and OpenSSF updates for any further guidance or remediation. There is no vendor advisory or official fix available at this time.

Summary

The package 'zpx52483db' version 0.0.1 in the RubyGems ecosystem has been identified as malicious by the OpenSSF and reported under MAL-2026-9671 (alias GHSA-4prq-j927-7g44). The source data does not provide further technical details about the nature of the malicious code or its behavior. This is a supply chain threat involving a malicious package published to RubyGems.

References

github.com/advisories/GHSA-4prq-j927-7g44 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 18 Jul 2026, 17:03 UTC

Technical details

References

Community reviews