{"id":"MAL-2026-18126","summary":"Malicious code in zzhelloworld_socktest (RubyGems)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4344ab16d08a7e38ea2f32b406453f86d792c0fa17103125ad84ffd0e39c187f)\nOn `require \"zzhelloworld_socktest\"`, the library's top-level module body opens a TCP connection to the hardcoded remote endpoint 66.78.40.218:32768, reopens STDIN, STDOUT, and STDERR onto that socket, and execs `/bin/sh -i`. Loading the gem gives the operator of that remote host an interactive shell on the installing machine, with no authentication and full process privileges. The gem's stated purpose is a trivial test library, which does not match a remote-shell capability. The destination is a bare IPv4 address unrelated to any declared publisher infrastructure.\n","modified":"2026-10-21T22:30:06.539192766Z","published":"2026-10-21T21:47:07Z","database_specific":{"malicious-packages-origins":[{"sha256":"00eefa91b94c7e3748de1b6d1c964c91592606507816ff51e54071e0b73dbd51","source":"amazon-inspector","versions":["0.1.9"],"id":"IN-MAL-2026-021555","import_time":"2026-10-21T22:16:18.292937557Z","modified_time":"2026-10-21T22:01:57Z"},{"modified_time":"2026-10-21T21:47:07Z","sha256":"2e11e9da0f4a2f8b06b1c4c1387a526ef38e43584c1fb4db814dff1333377140","source":"amazon-inspector","versions":["0.1.5"],"id":"IN-MAL-2026-021551","import_time":"2026-10-21T22:16:17.899683904Z"},{"source":"amazon-inspector","versions":["0.1.6"],"id":"IN-MAL-2026-021553","import_time":"2026-10-21T22:16:18.094595695Z","modified_time":"2026-10-21T21:47:20Z","sha256":"4344ab16d08a7e38ea2f32b406453f86d792c0fa17103125ad84ffd0e39c187f"},{"modified_time":"2026-10-21T22:02:06Z","sha256":"54f3d8d6b0e7bf929891e4906dfa8205b7205df6ac6f0b6dcf8502342fc49c18","source":"amazon-inspector","versions":["0.2.0"],"id":"IN-MAL-2026-021556","import_time":"2026-10-21T22:16:18.403267434Z"},{"versions":["0.1.7"],"id":"IN-MAL-2026-021552","import_time":"2026-10-21T22:16:17.99813523Z","modified_time":"2026-10-21T21:47:13Z","sha256":"6c20f8c727164e8ee07f7dfed2e15c9aa88d3119eac98045c3e7284303327ab8","source":"amazon-inspector"},{"modified_time":"2026-10-21T22:02:16Z","sha256":"b9d9d0a1e5212b4b412a292f78b24635113698cb1c590a4f39a4de5d4ebefb4d","source":"amazon-inspector","versions":["0.2.1"],"id":"IN-MAL-2026-021557","import_time":"2026-10-21T22:16:18.544695221Z"},{"modified_time":"2026-10-21T21:47:28Z","sha256":"e1e8e31f4fb323332234cbb199545db2d1f3b515341e16b4d713970353baad5c","source":"amazon-inspector","versions":["0.1.8"],"id":"IN-MAL-2026-021554","import_time":"2026-10-21T22:16:18.198572691Z"}]},"references":[{"type":"PACKAGE","url":"https://rubygems.org/gems/zzhelloworld_socktest/versions/0.1.9"},{"type":"PACKAGE","url":"https://rubygems.org/gems/zzhelloworld_socktest/versions/0.1.5"},{"type":"PACKAGE","url":"https://rubygems.org/gems/zzhelloworld_socktest/versions/0.1.6"},{"type":"PACKAGE","url":"https://rubygems.org/gems/zzhelloworld_socktest/versions/0.2.0"},{"type":"PACKAGE","url":"https://rubygems.org/gems/zzhelloworld_socktest/versions/0.1.7"},{"type":"PACKAGE","url":"https://rubygems.org/gems/zzhelloworld_socktest/versions/0.2.1"},{"type":"PACKAGE","url":"https://rubygems.org/gems/zzhelloworld_socktest/versions/0.1.8"}],"affected":[{"package":{"name":"zzhelloworld_socktest","ecosystem":"RubyGems","purl":"pkg:gem/zzhelloworld_socktest"},"versions":["0.1.9","0.1.5","0.1.6","0.2.0","0.1.7","0.2.1","0.1.8"],"database_specific":{"indicators":{"evidence_files":[{"path":"lib/zzhelloworld_socktest.rb","sha256":"b9126fcf18d64dfe1509a6c5b1203d256275362efb74d9e9799151e89f008630","tlsh":"92e0268da2319426b43a42cfe0e5b426a9a2d06b460aa46bb7f02b84ef071754ec0971"}],"package_integrity":[{"filename":"zzhelloworld_socktest-0.1.9.gem","hashes":{"sha256":"71d36652d66acaaa93586f70c97a52f59aaba0ecfbf2628080d266806a3f0db4"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/zzhelloworld_socktest/MAL-2026-18126.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}]}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}