MAL-2026-18462: Malicious code in intercom-react-native-example-e2e-tests (RubyGems)

Published Nov 2, 2026

Updated

--- -= Per source details. Do not edit below this line.=-

Source: amazon-inspector (57e084aff68cdd6201d55d3375bbc29f6e741553d4ac083f910fc38e110ef3d1) The gem declares ext/mkrfconf.rb as an extension script, so it runs automatically on gem install. The script collects host reconnaissance data (hostname, username, current working directory, home directory) and reads sensitive local files (/etc/resolv.conf, /etc/passwd, /etc/hosts), serializes them as JSON, and transmits them over a TLS TCP socket to the hardcoded host 4diaipklp71i0by89eduyffr2i8dw3ks.oastify.com (a Burp Collaborator / OAST subdomain). A DNS lookup to the same host is issued as an out-of-band beacon, and the payload is tagged with an identifier (myshoaib) to track successful landings. The package name mimics an unrelated JavaScript project (intercom-react-native), ships only an empty library module, and uses placeholder author metadata — consistent with a dependency-confusion / name-squat probe whose only functional behavior is the install-time exfiltration.

Source: ossf-package-analysis (f17f130fc5b4fa9192f15a6e914928336f4e591d424b5bec8696923519d2793f) The OpenSSF Package Analysis project identified 'intercom-react-native-example-e2e-tests' @ 1.0.1 (rubygems) as malicious.

It is considered malicious because:

- The package communicates with a domain associated with malicious activity.

Affected Software

1 affected component

rubygems/intercom-react-native-example-e2e-tests=1.0.1

Event History

Nov 2, 2026

Advisory Published

via OSV·10:25 AM

Data Sourced

via OSV·10:25 AM

DescriptionAffected Software

Frequently Asked Questions

Which systems are exposed during installation?

Any developer workstation, CI runner, build agent, or other host that runs gem install for this package is exposed. Its declared extension script runs automatically during installation, so application code does not need to invoke the gem.

What does an attacker need to trigger the behavior?

The package only needs to be installed through RubyGems for its extension script to execute. The package appears designed as a dependency-confusion or name-squat probe, so environments that resolve or install this gem name are the relevant exposure point.

What information may leave an affected host?

The install script collects the hostname, username, current working directory, and home directory, and reads /etc/resolv.conf, /etc/passwd, and /etc/hosts. It serializes this information as JSON and sends it over TLS to 4diaipklp71i0by89eduyffr2i8dw3ks.oastify.com, while also performing a DNS lookup to that host.

What can be done if the package cannot immediately be removed from a build environment?

Prevent the package from being installed or executed in build and development environments, and block DNS and outbound connections to 4diaipklp71i0by89eduyffr2i8dw3ks.oastify.com where possible. Treat the listed host and local-file data as potentially disclosed on systems where installation already occurred.

How can teams determine whether they may have been affected?

Review dependency manifests, lockfiles, RubyGems installation records, and CI/build logs for intercom-react-native-example-e2e-tests. Network and DNS telemetry for the hardcoded OAST hostname can also indicate that the install-time script ran.

MAL-2026-18462: Malicious code in intercom-react-native-example-e2e-tests (RubyGems)

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed during installation?

What does an attacker need to trigger the behavior?

What information may leave an affected host?

What can be done if the package cannot immediately be removed from a build environment?

How can teams determine whether they may have been affected?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed during installation?

What does an attacker need to trigger the behavior?

What information may leave an affected host?

What can be done if the package cannot immediately be removed from a build environment?

How can teams determine whether they may have been affected?