{"id":"MAL-2026-19177","summary":"Malicious code in pentest-copilot (RubyGems)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (23e305059e2c1f7f8f37b8478aa90214d1e916fc3f2287eb90f7bca7e9dcac32)\nThe gem declares an extension script (mkrf_conf.rb / RakeBuilder) that runs automatically on `gem install`. At install time it collects installer-side identifiers (current working directory, home directory, hostname, login name) and reads local files /etc/resolv.conf, /etc/passwd, and /etc/hosts, then performs a DNS lookup to the Burp Collaborator subdomain vfe1kgmcry39220zb5fl06hi49acy2mr.oastify.com and opens a TLS connection to the same host on port 443, POSTing the collected host identifiers and file contents in the request body. The Collaborator destination is attacker-controlled out-of-band infrastructure typical of install-time exfiltration beacons.\n\n## Source: ossf-package-analysis (8ed8a5f6d36e52a081b16492d7bc0cd65dc392d085384781cf3d661d47fca019)\nThe OpenSSF Package Analysis project identified 'pentest-copilot' @ 1.0.1 (rubygems) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","modified":"2026-11-12T20:15:03.341225514Z","published":"2026-11-12T17:40:54Z","database_specific":{"malicious-packages-origins":[{"sha256":"8ed8a5f6d36e52a081b16492d7bc0cd65dc392d085384781cf3d661d47fca019","source":"ossf-package-analysis","versions":["1.0.1"],"import_time":"2026-11-12T18:14:25.465927718Z","modified_time":"2026-11-12T17:40:54Z"},{"id":"IN-MAL-2026-022650","import_time":"2026-11-12T20:11:33.364530285Z","modified_time":"2026-11-12T19:56:48Z","sha256":"23e305059e2c1f7f8f37b8478aa90214d1e916fc3f2287eb90f7bca7e9dcac32","source":"amazon-inspector","versions":["1.0.1"]}]},"references":[{"type":"PACKAGE","url":"https://rubygems.org/gems/pentest-copilot/versions/1.0.1"}],"affected":[{"package":{"name":"pentest-copilot","ecosystem":"RubyGems","purl":"pkg:gem/pentest-copilot"},"versions":["1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"tlsh":"2d11cc8893587d61dba688afe20c308064d7dd8ac5095960fa9d48a0df6db3e33305fa","path":"ext/mkrf_conf.rb","sha256":"0872c1c9caf6513f3d62e81004a9668621f4eb492fe90d5f8b934f476c2a8282"}],"package_integrity":[{"hashes":{"sha256":"1e5097c9a1bbc59e48e52232bea642596eda7cd260d6deee1eb47794a7361144"},"filename":"pentest-copilot-1.0.1.gem"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/pentest-copilot/MAL-2026-19177.json"}}],"schema_version":"1.9.2","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}