MalwarePublished 7 Jul 2026Updated 24 Sep 2026

zz_arcdata (RubyGems) · Malicious Code

Affects zz_arcdataSource GCVE Database

Malicious package : remove zz_arcdata and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 16:06 UTC

Classification

Malicious package

Published to RubyGems · OSV MAL-2026-9934

What to do

Remove zz_arcdata from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
RubyGemszz_arcdata`pkg:gem/zz_arcdata`Other threats	Affected =0.0.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: ghsa-malware (e47bb43ada112287b29010bce1ab0f40e95accfa7c64ae4f5ef7453a64f2e01f) --- Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/9fbb5fba02ba2f02395d3d2d43c31b2c482b7a9d/osv/malicious/rubygems/zz_arcdata/MAL-2026-9934.json))

Impact

Users who install the zz_arcdata package version 0.0.1 may be exposed to malicious code execution or other harmful effects inherent to the package. The exact impact is not detailed, but the presence of malicious code in a dependency can compromise system integrity and security.

Defensive guidance

Avoid using the zz_arcdata package version 0.0.1. Since this is a malicious package, the recommended mitigation is to remove or not install this version. Users should verify dependencies and use trusted sources for RubyGems packages.

Summary

The zz_arcdata RubyGems package version 0.0.1 has been flagged as containing malicious code according to the OpenSSF malicious packages repository and the GCVE database. This indicates that the package was published with intent to perform malicious actions, posing a risk to users who install it. No further technical details or exploit mechanisms are described in the source data.

References

github.com/advisories/GHSA-xc92-vmgj-86cx (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 18 Jul 2026, 16:32 UTC

Technical details

References

Community reviews