Malicious code was identified in specific versions of the webpack-dev-server package distributed via RubyGems. The affected versions include 9.1.0, 9.9.0, 9.9.1, 9.9.8, and 9.9.9. This issue is classified as a malicious package threat rather than a traditional vulnerability. There is no CVSS score available, and no known exploits in the wild have been reported. No official patch or remediation guidance is provided in the available data.