MalwarePublished 7 Jul 2026Updated 24 Sep 2026

zwkopt10 (RubyGems) · Malicious Code

Affects zwkopt10Source GCVE Database

Malicious package : remove zwkopt10 and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:06 UTC

Classification

Malicious package

Published to RubyGems · OSV MAL-2026-9873

What to do

Remove zwkopt10 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
RubyGemszwkopt10`pkg:gem/zwkopt10`Other threats	Affected =0.0.3499	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: ghsa-malware (ed0bec9e9249a370b5e977076e0338644a688200fd7c9656dbe665895ade74db) --- Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/9fbb5fba02ba2f02395d3d2d43c31b2c482b7a9d/osv/malicious/rubygems/zwkopt10/MAL-2026-9873.json))

Impact

Use of the malicious 'zwkopt10' package version 0.0.3499 could lead to compromise of systems or codebases that incorporate it, depending on the nature of the embedded malicious code. Specific impacts are not detailed in the source data. No known active exploitation has been reported.

Defensive guidance

Since this is a malicious package, the primary mitigation is to avoid using version 0.0.3499 of 'zwkopt10'. Remove or replace this package if it is present in your environment. Monitor vendor or repository advisories for updates. Conduct supply chain security reviews to prevent inclusion of malicious packages.

Summary

The package 'zwkopt10' version 0.0.3499 in the RubyGems ecosystem has been flagged as containing malicious code according to the OpenSSF malicious packages repository. This is cataloged under MAL-2026-9873 and GHSA-49wf-g98w-rwvp. There is no CVSS score or detailed vulnerability description available. No known exploits in the wild have been reported. The threat is related to a malicious package rather than a traditional software vulnerability.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 18 Jul 2026, 16:39 UTC

Technical details

References

Community reviews