MAL-2026-19157: Malicious code in cheesebox (RubyGems)
--- -= Per source details. Do not edit below this line.=-
Source: amazon-inspector (5b03698e5384db9f041d0e2caa51db10abc0d0dcbfc1e5e77b795acc4d8cec76) The gem declares mkrfconf.rb as a native extension in its gemspec, causing it to execute automatically during gem install. On execution the script reads installer-side system files (/etc/passwd, /etc/hosts, /etc/resolv.conf) and collects host identifiers (hostname, username, home directory, current working directory), then opens a TLS TCPSocket to the hardcoded Burp Collaborator subdomain xwx31i3e80kbj4h1s7wnh8yklbrdf33s.oastify.com on port 443 and POSTs the collected data as JSON. The destination is an attacker-controlled out-of-band interaction host, not any infrastructure related to the gem's declared purpose, and the data read is unrelated to building a native extension (no mkmf probing, no compilation of shipped sources).
Affected Software
Event History
Frequently Asked Questions
What action triggers the malicious behavior?
The behavior runs automatically during gem installation because mkrf_conf.rb is declared as a native extension in the gemspec. No native-extension build activity is required beyond installing the gem.
What information can be exposed from an affected installation host?
The script reads /etc/passwd, /etc/hosts, and /etc/resolv.conf. It also collects the hostname, username, home directory, and current working directory before sending the data as JSON.
How can I check for potential exposure?
Check whether cheesebox version 10.0.1 was installed on the host. Network telemetry may also show TLS connections to xwx31i3e80kbj4h1s7wnh8yklbrdf33s.oastify.com on port 443 during installation.
What can be done if the affected gem cannot be trusted?
Avoid installing or executing the gem on systems containing sensitive host or account information. If it was installed, treat the listed system and host-identifier data as potentially disclosed to the hardcoded external host.