Malicious Package

Overview knot-rack-session-store is a malicious package. This package is part of a malicious cluster of Ruby gems published by the threat actor knot-theory. Designed to impersonate legitimate utilities, it executes a payload upon installation that harvests environment variables, SSH keys, AWS...

Malicious Package

Overview knot-devise-jwt-helper is a malicious package. This package is part of a malicious cluster of Ruby gems published by the threat actor knot-theory. Designed to impersonate legitimate utilities, it executes a payload upon installation that harvests environment variables, SSH keys, AWS...

Malicious Package

Overview knot-activesupport-logger is a malicious package. This package is part of a malicious cluster of Ruby gems published by the threat actor knot-theory. Designed to impersonate legitimate utilities, it executes a payload upon installation that harvests environment variables, SSH keys, AWS...

Malicious Package

Overview knot-rspec-formatter-json is a malicious package. This package is part of a malicious cluster of Ruby gems published by the threat actor knot-theory. Designed to impersonate legitimate utilities, it executes a payload upon installation that harvests environment variables, SSH keys, AWS...

Malicious Package

Overview knot-rails-assets-pipeline is a malicious package. This package is part of a malicious cluster of Ruby gems published by the threat actor knot-theory. Designed to impersonate legitimate utilities, it executes a payload upon installation that harvests environment variables, SSH keys, AWS...

Malicious Package

Overview knot-simple-formatter is a malicious package. This package is part of a malicious cluster of Ruby gems published by the threat actor knot-theory. Designed to impersonate legitimate utilities, it executes a payload upon installation that harvests environment variables, SSH keys, AWS...

Malicious Package

Overview knot-date-utils-rb is a malicious package. This package is part of a malicious cluster of Ruby gems published by the threat actor knot-theory. Designed to impersonate legitimate utilities, it executes a payload upon installation that harvests environment variables, SSH keys, AWS...

MAL-2026-3631 Malicious code in knot-date-utils-rb (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 48297dbd6277a3bbe08069409198e3cd7bac89bbbffe6d19d6239d80aea49ffc Source: google-open-source-security a4e4f74e90479d472a307d311d48214827e21cf93ecf9b0b62ff2cb72adb2c9e This package is a malicious packages part of the Go...

Malicious code in knot-rails-assets-pipeline (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d7789629b003bc80e1760952d135209a5a39e12810b2a6923666f55beacd2671 Source: google-open-source-security a4e4f74e90479d472a307d311d48214827e21cf93ecf9b0b62ff2cb72adb2c9e This package is a malicious packages part of the Go...

Malicious code in knot-rack-session-store (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0a2026dff78b5d4e39d988bc1cfe71b4b330dfbd42c2c9f0475d8e5373f574c Source: google-open-source-security a4e4f74e90479d472a307d311d48214827e21cf93ecf9b0b62ff2cb72adb2c9e This package is a malicious packages part of the Go...

Malicious code in knot-date-utils-rb (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 48297dbd6277a3bbe08069409198e3cd7bac89bbbffe6d19d6239d80aea49ffc Source: google-open-source-security a4e4f74e90479d472a307d311d48214827e21cf93ecf9b0b62ff2cb72adb2c9e This package is a malicious packages part of the Go...

Malicious code in knot-devise-jwt-helper (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 276381bb1ca0d7664992da8130d70f44c77debd2752b76bf42f2836d96217228 Source: google-open-source-security a4e4f74e90479d472a307d311d48214827e21cf93ecf9b0b62ff2cb72adb2c9e This package is a malicious packages part of the Go...

Malicious code in knot-simple-formatter (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ee2e8c938eb318bc3c2f10670add1e9851822caca703f8b66a11d81e4f0b6f69 Source: google-open-source-security a4e4f74e90479d472a307d311d48214827e21cf93ecf9b0b62ff2cb72adb2c9e This package is a malicious packages part of the Go...

MAL-2026-3634 Malicious code in knot-rails-assets-pipeline (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d7789629b003bc80e1760952d135209a5a39e12810b2a6923666f55beacd2671 Source: google-open-source-security a4e4f74e90479d472a307d311d48214827e21cf93ecf9b0b62ff2cb72adb2c9e This package is a malicious packages part of the Go...

Malicious code in knot-rspec-formatter-json (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 718487e021c5aced2cd0b54e6e0af5c06179cfd4860464fccda94d3d4a62189e Source: google-open-source-security a4e4f74e90479d472a307d311d48214827e21cf93ecf9b0b62ff2cb72adb2c9e This package is a malicious packages part of the Go...

MAL-2026-3636 Malicious code in knot-simple-formatter (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ee2e8c938eb318bc3c2f10670add1e9851822caca703f8b66a11d81e4f0b6f69 Source: google-open-source-security a4e4f74e90479d472a307d311d48214827e21cf93ecf9b0b62ff2cb72adb2c9e This package is a malicious packages part of the Go...

MAL-2026-3633 Malicious code in knot-rack-session-store (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0a2026dff78b5d4e39d988bc1cfe71b4b330dfbd42c2c9f0475d8e5373f574c Source: google-open-source-security a4e4f74e90479d472a307d311d48214827e21cf93ecf9b0b62ff2cb72adb2c9e This package is a malicious packages part of the Go...

MAL-2026-3632 Malicious code in knot-devise-jwt-helper (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 276381bb1ca0d7664992da8130d70f44c77debd2752b76bf42f2836d96217228 Source: google-open-source-security a4e4f74e90479d472a307d311d48214827e21cf93ecf9b0b62ff2cb72adb2c9e This package is a malicious packages part of the Go...

MAL-2026-3630 Malicious code in knot-activesupport-logger (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f827203d102f72b94d333cd5a651ecdd356517b209179504c2ae37a34b6129ec Source: google-open-source-security a4e4f74e90479d472a307d311d48214827e21cf93ecf9b0b62ff2cb72adb2c9e This package is a malicious packages part of the Go...

MAL-2026-3635 Malicious code in knot-rspec-formatter-json (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 718487e021c5aced2cd0b54e6e0af5c06179cfd4860464fccda94d3d4a62189e Source: google-open-source-security a4e4f74e90479d472a307d311d48214827e21cf93ecf9b0b62ff2cb72adb2c9e This package is a malicious packages part of the Go...