VYPR
← All malware advisories

gem · Malicious package advisory

Malware

wurl_show_data

GHSA-345f-5r88-8j64

Malicious code in wurl_show_data (RubyGems)

Details

**Severity:** Critical

**Affected versions:** `= 3.1.42.99`

## Source: ossf-package-analysis (17d2e80b42383fadbe9bde12ef17decad8b9dfa9b48f93b6e7f9162091e2a69d)
The OpenSSF Package Analysis project identified 'wurl_show_data' @ 3.1.42.99 (rubygems) as malicious.

It is considered malicious because:

- The package executes one or more commands associated with malicious behavior.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/d9a451cbb73776aade5f2f5ad3ae60f5eb2524ec/osv/malicious/rubygems/wurl_show_data/MAL-2026-16466.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/d9a451cbb73776aade5f2f5ad3ae60f5eb2524ec/osv/malicious/rubygems/wurl_show_data/MAL-2026-16466.json
- https://github.com/advisories/GHSA-345f-5r88-8j64

Compromised versions (1)

  • = 3.1.42.99

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.