{"affected":[{"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"ext/mkrf_conf.rb","sha256":"2eafe0ec8349008c90faf403997ad10c53fc7880d1d5794bd37225ef2d51e7d3","tlsh":"8011028957497d60ab92886fe54c208064a3dd6ac605a924bf9804a4cf6db6c23209fb"},{"path":"metadata.yaml","sha256":"73c1b27f19dcad5cefcfa1107f954d76c6d85b2fe53c8e3f5af8ac6d809ea290","tlsh":"9711ab80b6c3e8bbf501d2e64c503247f373d81cbea539019acbc1a543d556a3747265"}],"package_integrity":[{"filename":"intercom-react-native-example-e2e-tests-1.0.1.gem","hashes":{"sha256":"5151e3903b57de70ca7478bbc13132f375f0227d70f9bb51a7ad4d3e21fa170a"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/intercom-react-native-example-e2e-tests/MAL-2026-18462.json"},"package":{"ecosystem":"RubyGems","name":"intercom-react-native-example-e2e-tests","purl":"pkg:gem/intercom-react-native-example-e2e-tests"},"versions":["1.0.1"]}],"credits":[{"contact":["inspector-research@amazon.com"],"name":"Amazon Inspector","type":"FINDER"},{"contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"name":"OpenSSF: Package Analysis","type":"FINDER"}],"database_specific":{"malicious-packages-origins":[{"import_time":"2026-11-02T10:37:06.610574735Z","modified_time":"2026-11-02T10:25:43Z","sha256":"f17f130fc5b4fa9192f15a6e914928336f4e591d424b5bec8696923519d2793f","source":"ossf-package-analysis","versions":["1.0.1"]},{"id":"IN-MAL-2026-022482","import_time":"2026-11-02T21:10:54.389271988Z","modified_time":"2026-11-02T20:55:37Z","sha256":"57e084aff68cdd6201d55d3375bbc29f6e741553d4ac083f910fc38e110ef3d1","source":"amazon-inspector","versions":["1.0.1"]}]},"details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (57e084aff68cdd6201d55d3375bbc29f6e741553d4ac083f910fc38e110ef3d1)\nThe gem declares `ext/mkrf_conf.rb` as an extension script, so it runs automatically on `gem install`. The script collects host reconnaissance data (hostname, username, current working directory, home directory) and reads sensitive local files (`/etc/resolv.conf`, `/etc/passwd`, `/etc/hosts`), serializes them as JSON, and transmits them over a TLS TCP socket to the hardcoded host `4diaipklp71i0by89eduyffr2i8dw3ks.oastify.com` (a Burp Collaborator / OAST subdomain). A DNS lookup to the same host is issued as an out-of-band beacon, and the payload is tagged with an identifier (`my_shoaib`) to track successful landings. The package name mimics an unrelated JavaScript project (`intercom-react-native`), ships only an empty library module, and uses placeholder author metadata — consistent with a dependency-confusion / name-squat probe whose only functional behavior is the install-time exfiltration.\n\n## Source: ossf-package-analysis (f17f130fc5b4fa9192f15a6e914928336f4e591d424b5bec8696923519d2793f)\nThe OpenSSF Package Analysis project identified 'intercom-react-native-example-e2e-tests' @ 1.0.1 (rubygems) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","id":"MAL-2026-18462","modified":"2026-11-02T21:15:06.957726085Z","published":"2026-11-02T10:25:43Z","references":[{"type":"PACKAGE","url":"https://rubygems.org/gems/intercom-react-native-example-e2e-tests/versions/1.0.1"}],"schema_version":"1.9.2","summary":"Malicious code in intercom-react-native-example-e2e-tests (RubyGems)"}