MAL-2026-18765

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/donjon-ledger/MAL-2026-18765.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18765
Published
2026-11-08T09:39:40Z
Modified
2026-11-08T10:15:04Z
Summary
Malicious code in donjon-ledger (RubyGems)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (4ab38ebb03685b0ddfa31074b056e0a95da764170efe3026ed822ff7c8b3c247)

The gemspec declares ext/mkrf_conf.rb as a native extension, causing it to execute automatically during gem install. The script ships no C/C++/Rust sources and performs no build work. Instead it collects host identifiers (hostname, username) and reads /etc/passwd, /etc/hosts, and /etc/resolv.conf, then opens a TLS connection to the hardcoded Burp Collaborator subdomain 8enejtlpqb2m1fzcaieyzjgv3m9mxcl1.oastify.com on port 443 and POSTs the collected JSON. A DNS lookup to the same subdomain is also performed. The script writes a.installed marker and exits. The extension hook exists solely as an install-time execution vector for this exfiltration payload.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-022567",
            "import_time": "2026-11-08T10:11:09.148169564Z",
            "modified_time": "2026-11-08T09:39:40Z",
            "sha256": "4ab38ebb03685b0ddfa31074b056e0a95da764170efe3026ed822ff7c8b3c247",
            "source": "amazon-inspector",
            "versions": [
                "2.0.2"
            ]
        }
    ]
}
References
Credits

Affected packages

RubyGems / donjon-ledger

Package

Name
donjon-ledger
Purl
pkg:gem/donjon-ledger

Affected ranges

Affected versions

2.*
2.0.2

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "ext/mkrf_conf.rb",
            "sha256": "4c10bfa03c6576b7f654145e4293a5f31a0256530d00fa3e2ac8879e99a746d7",
            "tlsh": "2f1132c99384bdb06b57cc6ff24c205014a7d986c60669317b9948bccf6db2863719f5"
        },
        {
            "path": "metadata.yaml",
            "sha256": "060ae8b062436436a1f42b9733a5a52062dea9a5cc687f3cdc84a58b31b4d800",
            "tlsh": "4811bd80b6c7e47bf105d2e69c103307b3b2d50cbea638019a8bc2da43d556a3743261"
        }
    ],
    "package_integrity": [
        {
            "filename": "donjon-ledger-2.0.2.gem",
            "hashes": {
                "sha256": "2501fef0514d8321daddf561e5e3caf18bd09ed8136befe3a62b09681910dc9e"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/donjon-ledger/MAL-2026-18765.json"