MAL-2026-19156: Malicious code in buffer-code-exercise-api (RubyGems)
--- -= Per source details. Do not edit below this line.=-
Source: amazon-inspector (b575cb1f6c5f576af68398e3ad383942d6ec5f065456948bc51df018e7e0ab68) The gem declares ext/mkrfconf.rb as a native extension via the gemspec extensions: entry, which causes RubyGems to execute the script during gem install. The script performs no native build work and ships no native sources. Instead, it collects hostname, login name, current working directory, home directory, and the contents of /etc/passwd, /etc/hosts, and /etc/resolv.conf, JSON-encodes them, and POSTs them over TLS to the hardcoded host 0ef6jllhq32e17z4aaeqzbgn3e9fx5lu.oastify.com (a Burp Collaborator out-of-band interaction subdomain), preceded by a DNS probe to the same host. The destination is not associated with the package's publisher, and the files read bear no relation to building a native extension. The extension entry is used purely as an install-time execution vector.
Affected Software
Event History
Frequently Asked Questions
When does the malicious activity occur?
It occurs during gem installation. RubyGems executes ext/mkrf_conf.rb because the gemspec declares it as a native extension.
What information can be exposed by installing the gem?
The script collects the hostname, login name, current working directory, home directory, and the contents of /etc/passwd, /etc/hosts, and /etc/resolv.conf. It JSON-encodes this data and sends it over TLS to a hardcoded external host.
Does exploitation require an application to load or use the gem after installation?
No. The install-time extension hook is the execution vector, so the script runs as part of gem install rather than requiring the gem to be loaded by an application.
How can teams determine whether an installation may have triggered the data transfer?
Review installation records for buffer-code-exercise-api and monitor DNS or TLS connections to 0ef6jllhq32e17z4aaeqzbgn3e9fx5lu.oastify.com. The script first performs a DNS probe and then POSTs collected data to that host.