MAL-2026-18766: Malicious code in dynamic-object-handler (RubyGems)

Published Nov 8, 2026

Updated

--- -= Per source details. Do not edit below this line.=-

Source: amazon-inspector (bb6afd419500201966e8ccb55d2f3c8ea28caae5ec8bfc59a87dcf19ca9d022b) The gem declares mkrfconf.rb as a native extension in metadata.yaml, causing it to execute automatically during gem install. The script collects the installer's current working directory, home directory path, hostname, login name, and the contents of /etc/resolv.conf, /etc/passwd, and /etc/hosts, then opens a TCP+TLS connection to the hardcoded Burp Collaborator subdomain unl0sfubzxb8a18yj4nk85phc8i66wul.oastify.com on port 443 and POSTs the collected data. A DNS resolution of the same oastify.com subdomain is issued first, producing an out-of-band DNS callback that confirms code execution on the installer's host even when outbound TCP/443 is blocked. The oastify.com domain is PortSwigger's OAST (Burp Collaborator) service, used to receive attacker-controlled callbacks; it has no first-party relationship to the gem's advertised purpose.

Affected Software

1 affected component

rubygems/dynamic-object-handler=1.0.1

Event History

Nov 8, 2026

Advisory Published

via OSV·09:39 AM

Data Sourced

via OSV·09:39 AM

DescriptionAffected Software

Frequently Asked Questions

What action triggers the malicious code?

The code runs automatically when the gem is installed because mkrf_conf.rb is declared as a native extension in metadata.yaml. Installing the affected gem is sufficient to trigger execution on the installer's host.

What information can be exposed from an affected installation host?

The script collects the current working directory, home-directory path, hostname, login name, and the contents of /etc/resolv.conf, /etc/passwd, and /etc/hosts. It attempts to POST this information over TLS to a hardcoded oastify.com subdomain on port 443.

Can execution be detected if outbound HTTPS is blocked?

Yes. Before attempting the TLS connection, the script resolves the same hardcoded oastify.com subdomain, creating an out-of-band DNS callback. A DNS lookup for unl0sfubzxb8a18yj4nk85phc8i66wul.oastify.com from an installation host indicates the code executed.

What can be checked to identify affected activity?

Review gem installation activity for dynamic-object-handler version 1.0.1 and inspect DNS logs for queries to unl0sfubzxb8a18yj4nk85phc8i66wul.oastify.com. Network logs may also show TLS traffic to that hostname on port 443.

MAL-2026-18766: Malicious code in dynamic-object-handler (RubyGems)

Affected Software

Event History

Frequently Asked Questions

What action triggers the malicious code?

What information can be exposed from an affected installation host?

Can execution be detected if outbound HTTPS is blocked?

What can be checked to identify affected activity?

Company

Resources

Contact

Frequently Asked Questions

What action triggers the malicious code?

What information can be exposed from an affected installation host?

Can execution be detected if outbound HTTPS is blocked?

What can be checked to identify affected activity?