{"id":"MAL-2026-18764","summary":"Malicious code in control-character-command-injection (RubyGems)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (83327b9e45cb49b02f4a3681837f5acdc84f15373a85648f4409946e6fa72f75)\nThe gem declares an extension script in metadata.yaml that RubyGems executes during `gem install`. At install time the script reads host identifiers (hostname, username, current working directory, home directory) and the contents of /etc/resolv.conf, /etc/passwd, and /etc/hosts, then opens a TLS connection via TCPSocket to the Burp Collaborator subdomain xuv3zi1e60ibh4f1q7unf8wkjbpad01p.oastify.com on port 443 and POSTs the collected data as a JSON body. A DNS lookup to the same host is also performed. The destination is an out-of-band interaction host unrelated to any legitimate publisher infrastructure, and the behavior fires automatically on install without user interaction.\n","modified":"2026-11-08T10:15:03.333128448Z","published":"2026-11-08T09:40:01Z","database_specific":{"malicious-packages-origins":[{"sha256":"83327b9e45cb49b02f4a3681837f5acdc84f15373a85648f4409946e6fa72f75","source":"amazon-inspector","versions":["1.0.1"],"id":"IN-MAL-2026-022570","import_time":"2026-11-08T10:11:09.396682257Z","modified_time":"2026-11-08T09:40:01Z"}]},"references":[{"type":"PACKAGE","url":"https://rubygems.org/gems/control-character-command-injection/versions/1.0.1"}],"affected":[{"package":{"name":"control-character-command-injection","ecosystem":"RubyGems","purl":"pkg:gem/control-character-command-injection"},"versions":["1.0.1"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"path":"ext/mkrf_conf.rb","sha256":"2a41f40c24eb43e60a1ce005aa11b28063fbce37464f3a8180bc03e9f11d14ac","tlsh":"b11102889388bc715b53a46fdf0c204164d3d95ac60579357ad908b4cf6db3d23315fa"}],"package_integrity":[{"hashes":{"sha256":"da67d1bc1c6786405b35376deb6b65cf96ddbcc9b2fa5246423d789b34122a5e"},"filename":"control-character-command-injection-1.0.1.gem"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/control-character-command-injection/MAL-2026-18764.json"}}],"schema_version":"1.9.2","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}