Malicious RubyGem YARD --load directive in .yardopts executes script

Ankit Mehta@Secvyn

•updated Sep 16, 2026•0•0•2

Detects the execution of Ruby or Yard processes where specific command-line arguments (e.g., --load) are used to invoke potentially malicious Ruby script files like evil.rb, loader.rb, or script.rb. This pattern is indicative of an adversary leveraging existing legitimate tools to execute arbitrary script code.