MAL-2026-18598

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/brida-frida-hooks/MAL-2026-18598.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18598
Published
2026-11-04T02:57:49Z
Modified
2026-11-04T03:30:03Z
Summary
Malicious code in brida-frida-hooks (RubyGems)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (cc383ba7728e9aec64324ce8b1c9b354b0331d7c404888e39d1d127885381e1d)

The gem declares an extension script in its gemspec that executes during gem install. On install, the script collects installer identity and local system data — current working directory, home directory, hostname, username, and the contents of /etc/resolv.conf, /etc/passwd, and /etc/hosts — and POSTs them over TLS via a raw TCPSocket to the hardcoded Burp Collaborator subdomain bjyhowqsve7p6i4fflj14mly8pel2bq0.oastify.com on port 443. The exfiltration is unrelated to the gem's stated 'simple demo' purpose and runs automatically on default install.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-022532",
            "import_time": "2026-11-04T03:13:45.985285913Z",
            "modified_time": "2026-11-04T02:57:49Z",
            "sha256": "cc383ba7728e9aec64324ce8b1c9b354b0331d7c404888e39d1d127885381e1d",
            "source": "amazon-inspector",
            "versions": [
                "1.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

RubyGems / brida-frida-hooks

Package

Name
brida-frida-hooks
Purl
pkg:gem/brida-frida-hooks

Affected ranges

Affected versions

1.*
1.0.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "ext/mkrf_conf.rb",
            "sha256": "4baeb968680755ee32092bff70514a250fb6a0850f4d2b4aced73be7cf97640c",
            "tlsh": "8f111f8c9785bc759b5384bf960c30402493da8ac60925b4fbaa44b48f6db3c63314f6"
        }
    ],
    "package_integrity": [
        {
            "filename": "brida-frida-hooks-1.0.1.gem",
            "hashes": {
                "sha256": "1e8d10741693dd0bd6b50e5102cdc17891ce8f0e11ebb3fb1c08e388e0fc4f17"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/brida-frida-hooks/MAL-2026-18598.json"