mal-2026-18126

{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "lib/zzhelloworld_socktest.rb",
              "sha256": "b9126fcf18d64dfe1509a6c5b1203d256275362efb74d9e9799151e89f008630",
              "tlsh": "92e0268da2319426b43a42cfe0e5b426a9a2d06b460aa46bb7f02b84ef071754ec0971"
            }
          ],
          "package_integrity": [
            {
              "filename": "zzhelloworld_socktest-0.1.9.gem",
              "hashes": {
                "sha256": "71d36652d66acaaa93586f70c97a52f59aaba0ecfbf2628080d266806a3f0db4"
              }
            }
          ]
        },
        "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/zzhelloworld_socktest/MAL-2026-18126.json"
      },
      "package": {
        "ecosystem": "RubyGems",
        "name": "zzhelloworld_socktest",
        "purl": "pkg:gem/zzhelloworld_socktest"
      },
      "versions": [
        "0.1.9",
        "0.1.5",
        "0.1.6",
        "0.2.0",
        "0.1.7",
        "0.2.1",
        "0.1.8"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-021555",
        "import_time": "2026-10-21T22:16:18.292937557Z",
        "modified_time": "2026-10-21T22:01:57Z",
        "sha256": "00eefa91b94c7e3748de1b6d1c964c91592606507816ff51e54071e0b73dbd51",
        "source": "amazon-inspector",
        "versions": [
          "0.1.9"
        ]
      },
      {
        "id": "IN-MAL-2026-021551",
        "import_time": "2026-10-21T22:16:17.899683904Z",
        "modified_time": "2026-10-21T21:47:07Z",
        "sha256": "2e11e9da0f4a2f8b06b1c4c1387a526ef38e43584c1fb4db814dff1333377140",
        "source": "amazon-inspector",
        "versions": [
          "0.1.5"
        ]
      },
      {
        "id": "IN-MAL-2026-021553",
        "import_time": "2026-10-21T22:16:18.094595695Z",
        "modified_time": "2026-10-21T21:47:20Z",
        "sha256": "4344ab16d08a7e38ea2f32b406453f86d792c0fa17103125ad84ffd0e39c187f",
        "source": "amazon-inspector",
        "versions": [
          "0.1.6"
        ]
      },
      {
        "id": "IN-MAL-2026-021556",
        "import_time": "2026-10-21T22:16:18.403267434Z",
        "modified_time": "2026-10-21T22:02:06Z",
        "sha256": "54f3d8d6b0e7bf929891e4906dfa8205b7205df6ac6f0b6dcf8502342fc49c18",
        "source": "amazon-inspector",
        "versions": [
          "0.2.0"
        ]
      },
      {
        "id": "IN-MAL-2026-021552",
        "import_time": "2026-10-21T22:16:17.99813523Z",
        "modified_time": "2026-10-21T21:47:13Z",
        "sha256": "6c20f8c727164e8ee07f7dfed2e15c9aa88d3119eac98045c3e7284303327ab8",
        "source": "amazon-inspector",
        "versions": [
          "0.1.7"
        ]
      },
      {
        "id": "IN-MAL-2026-021557",
        "import_time": "2026-10-21T22:16:18.544695221Z",
        "modified_time": "2026-10-21T22:02:16Z",
        "sha256": "b9d9d0a1e5212b4b412a292f78b24635113698cb1c590a4f39a4de5d4ebefb4d",
        "source": "amazon-inspector",
        "versions": [
          "0.2.1"
        ]
      },
      {
        "id": "IN-MAL-2026-021554",
        "import_time": "2026-10-21T22:16:18.198572691Z",
        "modified_time": "2026-10-21T21:47:28Z",
        "sha256": "e1e8e31f4fb323332234cbb199545db2d1f3b515341e16b4d713970353baad5c",
        "source": "amazon-inspector",
        "versions": [
          "0.1.8"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4344ab16d08a7e38ea2f32b406453f86d792c0fa17103125ad84ffd0e39c187f)\nOn `require \"zzhelloworld_socktest\"`, the library's top-level module body opens a TCP connection to the hardcoded remote endpoint 66.78.40.218:32768, reopens STDIN, STDOUT, and STDERR onto that socket, and execs `/bin/sh -i`. Loading the gem gives the operator of that remote host an interactive shell on the installing machine, with no authentication and full process privileges. The gem's stated purpose is a trivial test library, which does not match a remote-shell capability. The destination is a bare IPv4 address unrelated to any declared publisher infrastructure.\n",
  "id": "MAL-2026-18126",
  "modified": "2026-10-21T22:30:06.539192766Z",
  "published": "2026-10-21T21:47:07Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://rubygems.org/gems/zzhelloworld_socktest/versions/0.1.9"
    },
    {
      "type": "PACKAGE",
      "url": "https://rubygems.org/gems/zzhelloworld_socktest/versions/0.1.5"
    },
    {
      "type": "PACKAGE",
      "url": "https://rubygems.org/gems/zzhelloworld_socktest/versions/0.1.6"
    },
    {
      "type": "PACKAGE",
      "url": "https://rubygems.org/gems/zzhelloworld_socktest/versions/0.2.0"
    },
    {
      "type": "PACKAGE",
      "url": "https://rubygems.org/gems/zzhelloworld_socktest/versions/0.1.7"
    },
    {
      "type": "PACKAGE",
      "url": "https://rubygems.org/gems/zzhelloworld_socktest/versions/0.2.1"
    },
    {
      "type": "PACKAGE",
      "url": "https://rubygems.org/gems/zzhelloworld_socktest/versions/0.1.8"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "Malicious code in zzhelloworld_socktest (RubyGems)"
}