MAL-2026-19177: Malicious code in pentest-copilot (RubyGems)
Published Nov 12, 2026
·Updated
--- -= Per source details. Do not edit below this line.=-
Source: ossf-package-analysis (8ed8a5f6d36e52a081b16492d7bc0cd65dc392d085384781cf3d661d47fca019) The OpenSSF Package Analysis project identified 'pentest-copilot' @ 1.0.1 (rubygems) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
Affected Software
1 affected component
rubygems/pentest-copilot=1.0.1
Event History
Nov 12, 2026
Advisory Published
via OSV·05:40 PM
Data Sourced
via OSV·05:40 PM
DescriptionAffected Software
Frequently Asked Questions
1
Which package version was identified as malicious?
The identified malicious package version is pentest-copilot 1.0.1 on RubyGems.
2
What behavior led to the malicious classification?
The package communicates with a domain associated with malicious activity.