rubygems package report

Is knot-devise-jwt-helper safe?

The malicious-package record for knot-devise-jwt-helper covers every version. We could not confirm this against the registry's release list. Check the references below before installing any version.

Malicious-package record: every version

CRITICAL

Malicious-package record, part of the MAL-2026-0513-BUFFERZONECORP campaign. Added to CyberXYZ 2026-05-13, OSV malicious-package feed (Google / OpenSSF).

// what we observed

This package is a malicious packages part of the Go BufferZoneCorp and RubyGems knot-theory clusters. The packages in this cluster steal credentials, set up ssh access and tamper with build/workflow environmetn variables.

Reported by Google Open Source Security via OSV.

// versions and what to do

Malicious: all versions

If one of these versions was installed, remove it and treat the credentials, tokens and SSH keys on that machine as exposed: rotate them. Check CI runners and container images that installed it too.

OSV record reference

// reach

0 direct dependencies

none carry a known advisory

0 packages depend on it

dependents not yet indexed for this ecosystem

Create a free accountfor every dependency path, dependent and what to upgrade

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so rubygems packages are not covered.

Checked 2026-10-31 at 00:03 UTC. Updated continuously from NVD, GHSA, OSV and CNA feeds.