MAL-2026-18599: Malicious code in w002yardprobe (RubyGems)
--- -= Per source details. Do not edit below this line.=-
Source: amazon-inspector (721580f8eda44ad5ee7604f5ba0648e8830302f784e3e4a995e02ca7359c909e) The gem ships a .yardopts file containing --load./script.rb, which causes YARD to execute script.rb whenever documentation is generated for the gem (locally via yard doc, in CI, or on doc-hosting services such as RubyDoc.info). script.rb collects host identifiers — Socket.gethostname, current working directory, UID, and RUBYVERSION — and POSTs them via Net::HTTP.postform to the hardcoded third-party collector https://webhook.site/97fa3c6a-3fad-4d2d-8312-15dc37e41e66. The same script also rewrites lib/w002yardprobe.rb in place (substituting a MARKSLOT token with a runtime stamp) and drops sentinel files W002SCRIPTRAN.txt and W002EGRESSOK.txt in the detected build directory (e.g. /build), indicating the gem is instrumented to probe a documentation-build sandbox. The package self-identifies as a probe; the exfiltration and build-environment mutation are the gem's purpose. The trigger is YARD doc generation rather than gem install or require, so the harm materializes against whichever host (developer workstation, CI runner, or doc-hosting pipeline) processes the gem's documentation.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this package's behavior?
Systems that generate YARD documentation for the gem are exposed, including developer workstations running `yard doc`, CI documentation jobs, and documentation-hosting services. Installing the gem or requiring it alone does not trigger the described behavior.
What does the documentation build script do when triggered?
It collects the hostname, current working directory, UID, and Ruby version, then submits them to a hardcoded third-party webhook. It also modifies `lib/w002yardprobe.rb` and creates `W002SCRIPT_RAN.txt` and `W002EGRESS_OK.txt` sentinel files in the detected build directory.
How can I determine whether the script ran in a build environment?
Look for `W002SCRIPT_RAN.txt` and `W002EGRESS_OK.txt` in the build directory, such as `/build`. Also inspect `lib/w002yardprobe.rb` for replacement of the `MARKSLOT` token with a runtime stamp.