{"id":"MAL-2026-18598","summary":"Malicious code in brida-frida-hooks (RubyGems)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (cc383ba7728e9aec64324ce8b1c9b354b0331d7c404888e39d1d127885381e1d)\nThe gem declares an extension script in its gemspec that executes during `gem install`. On install, the script collects installer identity and local system data — current working directory, home directory, hostname, username, and the contents of /etc/resolv.conf, /etc/passwd, and /etc/hosts — and POSTs them over TLS via a raw TCPSocket to the hardcoded Burp Collaborator subdomain bjyhowqsve7p6i4fflj14mly8pel2bq0.oastify.com on port 443. The exfiltration is unrelated to the gem's stated 'simple demo' purpose and runs automatically on default install.\n","modified":"2026-11-04T03:30:03.366059014Z","published":"2026-11-04T02:57:49Z","database_specific":{"malicious-packages-origins":[{"sha256":"cc383ba7728e9aec64324ce8b1c9b354b0331d7c404888e39d1d127885381e1d","source":"amazon-inspector","versions":["1.0.1"],"id":"IN-MAL-2026-022532","import_time":"2026-11-04T03:13:45.985285913Z","modified_time":"2026-11-04T02:57:49Z"}]},"references":[{"type":"PACKAGE","url":"https://rubygems.org/gems/brida-frida-hooks/versions/1.0.1"}],"affected":[{"package":{"name":"brida-frida-hooks","ecosystem":"RubyGems","purl":"pkg:gem/brida-frida-hooks"},"versions":["1.0.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/brida-frida-hooks/MAL-2026-18598.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"path":"ext/mkrf_conf.rb","sha256":"4baeb968680755ee32092bff70514a250fb6a0850f4d2b4aced73be7cf97640c","tlsh":"8f111f8c9785bc759b5384bf960c30402493da8ac60925b4fbaa44b48f6db3c63314f6"}],"package_integrity":[{"filename":"brida-frida-hooks-1.0.1.gem","hashes":{"sha256":"1e8d10741693dd0bd6b50e5102cdc17891ce8f0e11ebb3fb1c08e388e0fc4f17"}}]}}}],"schema_version":"1.9.2","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}