MalwarePublished 7 Jul 2026Updated 24 Sep 2026

zwan_cal_https (RubyGems) · Malicious Code

Affects zwan_cal_httpsSource GCVE Database

Malicious package : remove zwan_cal_https and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:06 UTC

Classification

Malicious package

Published to RubyGems · OSV MAL-2026-9836

What to do

Remove zwan_cal_https from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
RubyGemszwan_cal_https`pkg:gem/zwan_cal_https`Other threats	Affected =0.0.134	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: ghsa-malware (de3f56367eb657fca54df01a976a55d2fb3e8cd33f9288e186071ab772d0dbe3) --- Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/9fbb5fba02ba2f02395d3d2d43c31b2c482b7a9d/osv/malicious/rubygems/zwan_cal_https/MAL-2026-9836.json))

Impact

Use of the malicious 'zwan_cal_https' package version 0.0.134 could lead to the introduction of malicious code into dependent applications or environments. Specific impacts are not detailed in the source data, but the presence of malicious code typically risks unauthorized code execution, data compromise, or other malicious activities depending on the payload.

Defensive guidance

Users should avoid using the 'zwan_cal_https' package version 0.0.134. Removal or replacement with a trusted package is recommended. Since this is a malicious package, the vendor does not provide an official fix. Users should verify dependencies and ensure no usage of this package in their environments.

Summary

The 'zwan_cal_https' RubyGems package at version 0.0.134 has been identified as containing malicious code. This classification comes from the OpenSSF malicious packages repository and is cataloged under MAL-2026-9836 (alias GHSA-62jx-64wg-hpr6). There is no detailed technical description of the malicious behavior or exploitation methods in the provided data. The package is not a cloud service and no known exploits in the wild have been reported.

References

github.com/advisories/GHSA-62jx-64wg-hpr6 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 18 Jul 2026, 16:43 UTC

Technical details

References

Community reviews