{"id":"MAL-2026-19156","summary":"Malicious code in buffer-code-exercise-api (RubyGems)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b575cb1f6c5f576af68398e3ad383942d6ec5f065456948bc51df018e7e0ab68)\nThe gem declares ext/mkrf_conf.rb as a native extension via the gemspec `extensions:` entry, which causes RubyGems to execute the script during `gem install`. The script performs no native build work and ships no native sources. Instead, it collects hostname, login name, current working directory, home directory, and the contents of /etc/passwd, /etc/hosts, and /etc/resolv.conf, JSON-encodes them, and POSTs them over TLS to the hardcoded host 0ef6jllhq32e17z4aaeqzbgn3e9fx5lu.oastify.com (a Burp Collaborator out-of-band interaction subdomain), preceded by a DNS probe to the same host. The destination is not associated with the package's publisher, and the files read bear no relation to building a native extension. The extension entry is used purely as an install-time execution vector.\n","modified":"2026-11-12T16:30:05.032592977Z","published":"2026-11-12T15:51:49Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-022649","import_time":"2026-11-12T16:13:53.481802657Z","modified_time":"2026-11-12T15:51:49Z","sha256":"b575cb1f6c5f576af68398e3ad383942d6ec5f065456948bc51df018e7e0ab68","source":"amazon-inspector","versions":["1.0.1"]}]},"references":[{"type":"PACKAGE","url":"https://rubygems.org/gems/buffer-code-exercise-api/versions/1.0.1"}],"affected":[{"package":{"name":"buffer-code-exercise-api","ecosystem":"RubyGems","purl":"pkg:gem/buffer-code-exercise-api"},"versions":["1.0.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/buffer-code-exercise-api/MAL-2026-19156.json","indicators":{"package_integrity":[{"filename":"buffer-code-exercise-api-1.0.1.gem","hashes":{"sha256":"78134ed0f7174961a7510e0478ae477de0f63fdf0ef17f5ba57e597c05e283bf"}}],"evidence_files":[{"tlsh":"6f110299938d7c609b5284afd60cb4c26497dd86c5065c62bb9904a0cf6ef7d33305f5","path":"ext/mkrf_conf.rb","sha256":"4b4a59c95e189d6d47ae981157f6a64b0d7a2271accd155e3c17f2f881b59abe"},{"sha256":"043781dea297aca4ad762b455826ba1b4818a946e91e3d403570984ba239742e","tlsh":"65119b80bac7e47af101e2e75c103707b3b3d918bea63c019a8bd2ea03d596a3747165","path":"metadata.yaml"}]},"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.9.2","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}