MAL-2026-18126

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/zzhelloworld_socktest/MAL-2026-18126.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18126
Published
2026-10-21T21:47:07Z
Modified
2026-10-21T22:30:06Z
Summary
Malicious code in zzhelloworld_socktest (RubyGems)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (4344ab16d08a7e38ea2f32b406453f86d792c0fa17103125ad84ffd0e39c187f)

On require "zzhelloworld_socktest", the library's top-level module body opens a TCP connection to the hardcoded remote endpoint 66.78.40.218:32768, reopens STDIN, STDOUT, and STDERR onto that socket, and execs /bin/sh -i. Loading the gem gives the operator of that remote host an interactive shell on the installing machine, with no authentication and full process privileges. The gem's stated purpose is a trivial test library, which does not match a remote-shell capability. The destination is a bare IPv4 address unrelated to any declared publisher infrastructure.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-021555",
            "import_time":  "2026-10-21T22:16:18.292937557Z",
            "modified_time":  "2026-10-21T22:01:57Z",
            "sha256":  "00eefa91b94c7e3748de1b6d1c964c91592606507816ff51e54071e0b73dbd51",
            "source":  "amazon-inspector",
            "versions":  [
                "0.1.9"
            ]
        },
        {
            "id":  "IN-MAL-2026-021551",
            "import_time":  "2026-10-21T22:16:17.899683904Z",
            "modified_time":  "2026-10-21T21:47:07Z",
            "sha256":  "2e11e9da0f4a2f8b06b1c4c1387a526ef38e43584c1fb4db814dff1333377140",
            "source":  "amazon-inspector",
            "versions":  [
                "0.1.5"
            ]
        },
        {
            "id":  "IN-MAL-2026-021553",
            "import_time":  "2026-10-21T22:16:18.094595695Z",
            "modified_time":  "2026-10-21T21:47:20Z",
            "sha256":  "4344ab16d08a7e38ea2f32b406453f86d792c0fa17103125ad84ffd0e39c187f",
            "source":  "amazon-inspector",
            "versions":  [
                "0.1.6"
            ]
        },
        {
            "id":  "IN-MAL-2026-021556",
            "import_time":  "2026-10-21T22:16:18.403267434Z",
            "modified_time":  "2026-10-21T22:02:06Z",
            "sha256":  "54f3d8d6b0e7bf929891e4906dfa8205b7205df6ac6f0b6dcf8502342fc49c18",
            "source":  "amazon-inspector",
            "versions":  [
                "0.2.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-021552",
            "import_time":  "2026-10-21T22:16:17.99813523Z",
            "modified_time":  "2026-10-21T21:47:13Z",
            "sha256":  "6c20f8c727164e8ee07f7dfed2e15c9aa88d3119eac98045c3e7284303327ab8",
            "source":  "amazon-inspector",
            "versions":  [
                "0.1.7"
            ]
        },
        {
            "id":  "IN-MAL-2026-021557",
            "import_time":  "2026-10-21T22:16:18.544695221Z",
            "modified_time":  "2026-10-21T22:02:16Z",
            "sha256":  "b9d9d0a1e5212b4b412a292f78b24635113698cb1c590a4f39a4de5d4ebefb4d",
            "source":  "amazon-inspector",
            "versions":  [
                "0.2.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-021554",
            "import_time":  "2026-10-21T22:16:18.198572691Z",
            "modified_time":  "2026-10-21T21:47:28Z",
            "sha256":  "e1e8e31f4fb323332234cbb199545db2d1f3b515341e16b4d713970353baad5c",
            "source":  "amazon-inspector",
            "versions":  [
                "0.1.8"
            ]
        }
    ]
}
References
Credits

Affected packages

RubyGems / zzhelloworld_socktest

Package

Name
zzhelloworld_socktest
Purl
pkg:gem/zzhelloworld_socktest

Affected ranges

Affected versions

0.*
0.1.5
0.1.6
0.1.7
0.1.8
0.1.9
0.2.0
0.2.1

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "lib/zzhelloworld_socktest.rb",
            "sha256":  "b9126fcf18d64dfe1509a6c5b1203d256275362efb74d9e9799151e89f008630",
            "tlsh":  "92e0268da2319426b43a42cfe0e5b426a9a2d06b460aa46bb7f02b84ef071754ec0971"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "zzhelloworld_socktest-0.1.9.gem",
            "hashes":  {
                "sha256":  "71d36652d66acaaa93586f70c97a52f59aaba0ecfbf2628080d266806a3f0db4"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/zzhelloworld_socktest/MAL-2026-18126.json"