file_path

evil.rb

discovered 2026-09-18

Attacker payload script filename used across the GemStuffer / 'OpenAI Swarm' campaign, loaded via a gem's .yardopts '--load' directive to achieve RCE during a RubyDoc.info documentation build. Confirmed exact reference in [email protected]: '--load ./evil.rb'.

Campaigns

Linked packages

Read the full analysis →