MAL-2026-18764

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/control-character-command-injection/MAL-2026-18764.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18764
Published
2026-11-08T09:40:01Z
Modified
2026-11-08T10:15:03Z
Summary
Malicious code in control-character-command-injection (RubyGems)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (83327b9e45cb49b02f4a3681837f5acdc84f15373a85648f4409946e6fa72f75)

The gem declares an extension script in metadata.yaml that RubyGems executes during gem install. At install time the script reads host identifiers (hostname, username, current working directory, home directory) and the contents of /etc/resolv.conf, /etc/passwd, and /etc/hosts, then opens a TLS connection via TCPSocket to the Burp Collaborator subdomain xuv3zi1e60ibh4f1q7unf8wkjbpad01p.oastify.com on port 443 and POSTs the collected data as a JSON body. A DNS lookup to the same host is also performed. The destination is an out-of-band interaction host unrelated to any legitimate publisher infrastructure, and the behavior fires automatically on install without user interaction.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-022570",
            "import_time": "2026-11-08T10:11:09.396682257Z",
            "modified_time": "2026-11-08T09:40:01Z",
            "sha256": "83327b9e45cb49b02f4a3681837f5acdc84f15373a85648f4409946e6fa72f75",
            "source": "amazon-inspector",
            "versions": [
                "1.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

RubyGems / control-character-command-injection

Package

Name
control-character-command-injection
Purl
pkg:gem/control-character-command-injection

Affected ranges

Affected versions

1.*
1.0.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "ext/mkrf_conf.rb",
            "sha256": "2a41f40c24eb43e60a1ce005aa11b28063fbce37464f3a8180bc03e9f11d14ac",
            "tlsh": "b11102889388bc715b53a46fdf0c204164d3d95ac60579357ad908b4cf6db3d23315fa"
        }
    ],
    "package_integrity": [
        {
            "filename": "control-character-command-injection-1.0.1.gem",
            "hashes": {
                "sha256": "da67d1bc1c6786405b35376deb6b65cf96ddbcc9b2fa5246423d789b34122a5e"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/control-character-command-injection/MAL-2026-18764.json"