MAL-2026-19177

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/pentest-copilot/MAL-2026-19177.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-19177
Published
2026-11-12T17:40:54Z
Modified
2026-11-12T20:15:03Z
Summary
Malicious code in pentest-copilot (RubyGems)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (23e305059e2c1f7f8f37b8478aa90214d1e916fc3f2287eb90f7bca7e9dcac32)

The gem declares an extension script (mkrf_conf.rb / RakeBuilder) that runs automatically on gem install. At install time it collects installer-side identifiers (current working directory, home directory, hostname, login name) and reads local files /etc/resolv.conf, /etc/passwd, and /etc/hosts, then performs a DNS lookup to the Burp Collaborator subdomain vfe1kgmcry39220zb5fl06hi49acy2mr.oastify.com and opens a TLS connection to the same host on port 443, POSTing the collected host identifiers and file contents in the request body. The Collaborator destination is attacker-controlled out-of-band infrastructure typical of install-time exfiltration beacons.

Source: ossf-package-analysis (8ed8a5f6d36e52a081b16492d7bc0cd65dc392d085384781cf3d661d47fca019)

The OpenSSF Package Analysis project identified 'pentest-copilot' @ 1.0.1 (rubygems) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.
Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-11-12T18:14:25.465927718Z",
            "modified_time": "2026-11-12T17:40:54Z",
            "sha256": "8ed8a5f6d36e52a081b16492d7bc0cd65dc392d085384781cf3d661d47fca019",
            "source": "ossf-package-analysis",
            "versions": [
                "1.0.1"
            ]
        },
        {
            "id": "IN-MAL-2026-022650",
            "import_time": "2026-11-12T20:11:33.364530285Z",
            "modified_time": "2026-11-12T19:56:48Z",
            "sha256": "23e305059e2c1f7f8f37b8478aa90214d1e916fc3f2287eb90f7bca7e9dcac32",
            "source": "amazon-inspector",
            "versions": [
                "1.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

RubyGems / pentest-copilot

Package

Name
pentest-copilot
Purl
pkg:gem/pentest-copilot

Affected ranges

Affected versions

1.*
1.0.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "ext/mkrf_conf.rb",
            "sha256": "0872c1c9caf6513f3d62e81004a9668621f4eb492fe90d5f8b934f476c2a8282",
            "tlsh": "2d11cc8893587d61dba688afe20c308064d7dd8ac5095960fa9d48a0df6db3e33305fa"
        }
    ],
    "package_integrity": [
        {
            "filename": "pentest-copilot-1.0.1.gem",
            "hashes": {
                "sha256": "1e5097c9a1bbc59e48e52232bea642596eda7cd260d6deee1eb47794a7361144"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/pentest-copilot/MAL-2026-19177.json"