MAL-2026-19156

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/buffer-code-exercise-api/MAL-2026-19156.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-19156
Published
2026-11-12T15:51:49Z
Modified
2026-11-12T16:30:05Z
Summary
Malicious code in buffer-code-exercise-api (RubyGems)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b575cb1f6c5f576af68398e3ad383942d6ec5f065456948bc51df018e7e0ab68)

The gem declares ext/mkrf_conf.rb as a native extension via the gemspec extensions: entry, which causes RubyGems to execute the script during gem install. The script performs no native build work and ships no native sources. Instead, it collects hostname, login name, current working directory, home directory, and the contents of /etc/passwd, /etc/hosts, and /etc/resolv.conf, JSON-encodes them, and POSTs them over TLS to the hardcoded host 0ef6jllhq32e17z4aaeqzbgn3e9fx5lu.oastify.com (a Burp Collaborator out-of-band interaction subdomain), preceded by a DNS probe to the same host. The destination is not associated with the package's publisher, and the files read bear no relation to building a native extension. The extension entry is used purely as an install-time execution vector.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-022649",
            "import_time": "2026-11-12T16:13:53.481802657Z",
            "modified_time": "2026-11-12T15:51:49Z",
            "sha256": "b575cb1f6c5f576af68398e3ad383942d6ec5f065456948bc51df018e7e0ab68",
            "source": "amazon-inspector",
            "versions": [
                "1.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

RubyGems / buffer-code-exercise-api

Package

Name
buffer-code-exercise-api
Purl
pkg:gem/buffer-code-exercise-api

Affected ranges

Affected versions

1.*
1.0.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "ext/mkrf_conf.rb",
            "sha256": "4b4a59c95e189d6d47ae981157f6a64b0d7a2271accd155e3c17f2f881b59abe",
            "tlsh": "6f110299938d7c609b5284afd60cb4c26497dd86c5065c62bb9904a0cf6ef7d33305f5"
        },
        {
            "path": "metadata.yaml",
            "sha256": "043781dea297aca4ad762b455826ba1b4818a946e91e3d403570984ba239742e",
            "tlsh": "65119b80bac7e47af101e2e75c103707b3b3d918bea63c019a8bd2ea03d596a3747165"
        }
    ],
    "package_integrity": [
        {
            "filename": "buffer-code-exercise-api-1.0.1.gem",
            "hashes": {
                "sha256": "78134ed0f7174961a7510e0478ae477de0f63fdf0ef17f5ba57e597c05e283bf"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/buffer-code-exercise-api/MAL-2026-19156.json"