MAL-2026-18598: Malicious code in brida-frida-hooks (RubyGems)
--- -= Per source details. Do not edit below this line.=-
Source: amazon-inspector (cc383ba7728e9aec64324ce8b1c9b354b0331d7c404888e39d1d127885381e1d) The gem declares an extension script in its gemspec that executes during gem install. On install, the script collects installer identity and local system data — current working directory, home directory, hostname, username, and the contents of /etc/resolv.conf, /etc/passwd, and /etc/hosts — and POSTs them over TLS via a raw TCPSocket to the hardcoded Burp Collaborator subdomain bjyhowqsve7p6i4fflj14mly8pel2bq0.oastify.com on port 443. The exfiltration is unrelated to the gem's stated 'simple demo' purpose and runs automatically on default install.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this package's behavior?
Any system where brida-frida-hooks is installed is exposed, because the extension script runs automatically during a default gem install. The affected installation process collects data from the account and host performing the install.
What data is sent from an affected system?
The install script collects the current working directory, home directory, hostname, username, and the contents of /etc/resolv.conf, /etc/passwd, and /etc/hosts. It POSTs this data over TLS to a hardcoded Burp Collaborator subdomain on port 443.
What can be done if the package was already installed?
Treat the system and installation account details listed as potentially disclosed. Review outbound connections or proxy logs for traffic to bjyhowqsve7p6i4fflj14mly8pel2bq0.oastify.com on port 443, and avoid further installations of the gem.