MAL-2026-18436: Malicious code in macs-shoaibs-pro17 (RubyGems)
--- -= Per source details. Do not edit below this line.=-
Source: amazon-inspector (0c7ce0186e7517c1df32cfd61177f90bee77d43a19d7c3963cc657e07109123a) The gem declares ext/mkrfconf.rb as a native extension, which RubyGems auto-executes during gem install. The script contains no mkmf/rake build logic (no createmakefile, haveheader, or compiler invocation). Instead it reads /etc/passwd, /etc/hosts, /etc/resolv.conf, the hostname, the current user, and the working directory, opens a TLS connection via TCPSocket to d5jjaycuhgtrskqh1n53qo70ur0kobc0.oastify.com:443 (a Burp Collaborator subdomain), and POSTs the collected data to that host before writing a.installed marker. The gemspec summary ("A simple gem for demonstration purposes") does not correspond to any functionality present in the package.
Source: ossf-package-analysis (b839ba696947a26e059bc82d4feb35120e11ff4885ff5bc5da19d9800f51f837) The OpenSSF Package Analysis project identified 'macs-shoaibs-pro17' @ 90002.1 (rubygems) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.