MAL-2026-18764: Malicious code in control-character-command-injection (RubyGems)

Published Nov 8, 2026

Updated

--- -= Per source details. Do not edit below this line.=-

Source: amazon-inspector (83327b9e45cb49b02f4a3681837f5acdc84f15373a85648f4409946e6fa72f75) The gem declares an extension script in metadata.yaml that RubyGems executes during gem install. At install time the script reads host identifiers (hostname, username, current working directory, home directory) and the contents of /etc/resolv.conf, /etc/passwd, and /etc/hosts, then opens a TLS connection via TCPSocket to the Burp Collaborator subdomain xuv3zi1e60ibh4f1q7unf8wkjbpad01p.oastify.com on port 443 and POSTs the collected data as a JSON body. A DNS lookup to the same host is also performed. The destination is an out-of-band interaction host unrelated to any legitimate publisher infrastructure, and the behavior fires automatically on install without user interaction.

Affected Software

1 affected component

rubygems/control-character-command-injection=1.0.1

Event History

Nov 8, 2026

Advisory Published

via OSV·09:40 AM

Data Sourced

via OSV·09:40 AM

DescriptionAffected Software

Frequently Asked Questions

What systems are exposed to this behavior?

Any host on which this gem is installed with RubyGems is exposed, because the extension script runs automatically during gem installation. The script collects the hostname, username, current working directory, home directory, and contents of /etc/resolv.conf, /etc/passwd, and /etc/hosts.

What network activity should defenders look for?

Look for DNS queries or TLS connections to xuv3zi1e60ibh4f1q7unf8wkjbpad01p.oastify.com, particularly outbound connections on port 443 made during gem installation. The collected data is sent in a JSON POST body.

Does exploitation require an application to load or use the gem?

No. The described behavior occurs during gem install when RubyGems executes the extension script; no additional user interaction is required.

MAL-2026-18764: Malicious code in control-character-command-injection (RubyGems)

Affected Software

Event History

Frequently Asked Questions

What systems are exposed to this behavior?

What network activity should defenders look for?

Does exploitation require an application to load or use the gem?

Company

Resources

Contact

Frequently Asked Questions

What systems are exposed to this behavior?

What network activity should defenders look for?

Does exploitation require an application to load or use the gem?