MAL-2026-18461: Malicious code in shoaib-unity (RubyGems)
--- -= Per source details. Do not edit below this line.=-
Source: amazon-inspector (01fd98b807f4f85a6e016b143dec086ea16de731fb1de0cd84763dbf5d8f6919) The gem declares an extension script (mkrfconf.rb) that runs automatically during gem install. On execution, it collects installer host identifiers (current working directory, home directory, hostname, username) and reads the contents of /etc/resolv.conf, /etc/passwd, and /etc/hosts, serializes them as JSON, and transmits them over a TLS TCPSocket POST to the hardcoded host d8mjdyfukgwrvkth4n83toa0xr3lrgf5.oastify.com. Prior to the HTTP POST, the script performs a DNS resolution of the same oastify.com subdomain, providing a secondary out-of-band beacon via the attacker's DNS logs. oastify.com is PortSwigger Burp Collaborator infrastructure; a hardcoded unique subdomain in a published gem is a dedicated exfiltration channel to the publisher, not a legitimate telemetry sink.
Source: ossf-package-analysis (ba322db91ecd6b863e8b06aa24b804a27f29cf2c8e2954bc1e77d7dc45e2fd52) The OpenSSF Package Analysis project identified 'shoaib-unity' @ 1.0.1 (rubygems) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.