{"id":"MAL-2026-19157","summary":"Malicious code in cheesebox (RubyGems)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5b03698e5384db9f041d0e2caa51db10abc0d0dcbfc1e5e77b795acc4d8cec76)\nThe gem declares mkrf_conf.rb as a native extension in its gemspec, causing it to execute automatically during `gem install`. On execution the script reads installer-side system files (/etc/passwd, /etc/hosts, /etc/resolv.conf) and collects host identifiers (hostname, username, home directory, current working directory), then opens a TLS TCPSocket to the hardcoded Burp Collaborator subdomain xwx31i3e80kbj4h1s7wnh8yklbrdf33s.oastify.com on port 443 and POSTs the collected data as JSON. The destination is an attacker-controlled out-of-band interaction host, not any infrastructure related to the gem's declared purpose, and the data read is unrelated to building a native extension (no mkmf probing, no compilation of shipped sources).\n","modified":"2026-11-12T16:30:05.040708260Z","published":"2026-11-12T15:51:40Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-022648","import_time":"2026-11-12T16:13:53.337029441Z","modified_time":"2026-11-12T15:51:40Z","sha256":"5b03698e5384db9f041d0e2caa51db10abc0d0dcbfc1e5e77b795acc4d8cec76","source":"amazon-inspector","versions":["10.0.1"]}]},"references":[{"type":"PACKAGE","url":"https://rubygems.org/gems/cheesebox/versions/10.0.1"}],"affected":[{"package":{"name":"cheesebox","ecosystem":"RubyGems","purl":"pkg:gem/cheesebox"},"versions":["10.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"cheesebox-10.0.1.gem","hashes":{"sha256":"c020e06f85c8f9ad442392d84b8b0e9608b19484c8e81e9e058e999568501e9a"}}],"evidence_files":[{"sha256":"298d01af34f1ff9361870ff26078aff9a19249828e81056e2f3b877268124bc8","tlsh":"ad11328857897cf06b6288efd14c20826493ce5aca452462ff9944a0cfadb3c33319f9","path":"ext/mkrf_conf.rb"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/cheesebox/MAL-2026-19157.json"}}],"schema_version":"1.9.2","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}