MAL-2026-18599

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/w002yardprobe/MAL-2026-18599.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18599
Published
2026-11-04T02:58:21Z
Modified
2026-11-04T03:30:03Z
Summary
Malicious code in w002yardprobe (RubyGems)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (721580f8eda44ad5ee7604f5ba0648e8830302f784e3e4a995e02ca7359c909e)

The gem ships a .yardopts file containing --load./script.rb, which causes YARD to execute script.rb whenever documentation is generated for the gem (locally via yard doc, in CI, or on doc-hosting services such as RubyDoc.info). script.rb collects host identifiers — Socket.gethostname, current working directory, UID, and RUBY_VERSION — and POSTs them via Net::HTTP.post_form to the hardcoded third-party collector https://webhook.site/97fa3c6a-3fad-4d2d-8312-15dc37e41e66. The same script also rewrites lib/w002yardprobe.rb in place (substituting a MARKSLOT token with a runtime stamp) and drops sentinel files W002SCRIPT_RAN.txt and W002EGRESS_OK.txt in the detected build directory (e.g. /build), indicating the gem is instrumented to probe a documentation-build sandbox. The package self-identifies as a probe; the exfiltration and build-environment mutation are the gem's purpose. The trigger is YARD doc generation rather than gem install or require, so the harm materializes against whichever host (developer workstation, CI runner, or doc-hosting pipeline) processes the gem's documentation.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-022534",
            "import_time": "2026-11-04T03:13:46.189246589Z",
            "modified_time": "2026-11-04T02:58:29Z",
            "sha256": "5252a1d5dd27d6e0edd3c1fc3936ff09d93b2fcc8e5544afc09fe7fb7d90bee5",
            "source": "amazon-inspector",
            "versions": [
                "0.0.4"
            ]
        },
        {
            "id": "IN-MAL-2026-022533",
            "import_time": "2026-11-04T03:13:46.098494137Z",
            "modified_time": "2026-11-04T02:58:21Z",
            "sha256": "721580f8eda44ad5ee7604f5ba0648e8830302f784e3e4a995e02ca7359c909e",
            "source": "amazon-inspector",
            "versions": [
                "0.0.5"
            ]
        }
    ]
}
References
Credits

Affected packages

RubyGems / w002yardprobe

Package

Name
w002yardprobe
Purl
pkg:gem/w002yardprobe

Affected ranges

Affected versions

0.*
0.0.4
0.0.5

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "script.rb",
            "sha256": "1a9aaf4ada6ff1225a0c9066bcc9ba27f91ce8eaf928fcfed5e32939e21a4f89",
            "tlsh": "dc4142725cc14d7b67e0e4483e2c1550f762614fc70418703aad426a2f65d3ba2b5bfb"
        }
    ],
    "package_integrity": [
        {
            "filename": "w002yardprobe-0.0.4.gem",
            "hashes": {
                "sha256": "2c92205c8a1ecbffe953de63a4308e7de19bff714f6b01a67f1780bd38f39794"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/w002yardprobe/MAL-2026-18599.json"