mal-2026-18436

{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "ext/mkrf_conf.rb",
              "sha256": "d0d53b5bdb14b9b6bbb54cf381bd929d86fc8cbd796c14a4cf1bbc85f05b5716",
              "tlsh": "3011658993987ca05b9ac86fe20c304160e7cd4bc50a6531bb8a0de0cf6db3c63316f9"
            }
          ],
          "package_integrity": [
            {
              "filename": "macs-shoaibs-pro17-90002.1.gem",
              "hashes": {
                "sha256": "42250485012302d3e623177f20965a9e566ee2bcb942056614a95c824163d0b3"
              }
            }
          ]
        },
        "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/macs-shoaibs-pro17/MAL-2026-18436.json"
      },
      "package": {
        "ecosystem": "RubyGems",
        "name": "macs-shoaibs-pro17",
        "purl": "pkg:gem/macs-shoaibs-pro17"
      },
      "versions": [
        "90002.1"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    },
    {
      "contact": [
        "https://github.com/ossf/package-analysis",
        "https://openssf.slack.com/channels/package_analysis"
      ],
      "name": "OpenSSF: Package Analysis",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "import_time": "2026-11-01T10:35:43.320256405Z",
        "modified_time": "2026-11-01T10:15:35Z",
        "sha256": "b839ba696947a26e059bc82d4feb35120e11ff4885ff5bc5da19d9800f51f837",
        "source": "ossf-package-analysis",
        "versions": [
          "90002.1"
        ]
      },
      {
        "id": "IN-MAL-2026-022480",
        "import_time": "2026-11-02T02:17:04.6085334Z",
        "modified_time": "2026-11-02T01:56:00Z",
        "sha256": "0c7ce0186e7517c1df32cfd61177f90bee77d43a19d7c3963cc657e07109123a",
        "source": "amazon-inspector",
        "versions": [
          "90002.1"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0c7ce0186e7517c1df32cfd61177f90bee77d43a19d7c3963cc657e07109123a)\nThe gem declares ext/mkrf_conf.rb as a native extension, which RubyGems auto-executes during `gem install`. The script contains no mkmf/rake build logic (no create_makefile, have_header, or compiler invocation). Instead it reads /etc/passwd, /etc/hosts, /etc/resolv.conf, the hostname, the current user, and the working directory, opens a TLS connection via TCPSocket to d5jjaycuhgtrskqh1n53qo70ur0kobc0.oastify.com:443 (a Burp Collaborator subdomain), and POSTs the collected data to that host before writing a.installed marker. The gemspec summary (\"A simple gem for demonstration purposes\") does not correspond to any functionality present in the package.\n\n## Source: ossf-package-analysis (b839ba696947a26e059bc82d4feb35120e11ff4885ff5bc5da19d9800f51f837)\nThe OpenSSF Package Analysis project identified 'macs-shoaibs-pro17' @ 90002.1 (rubygems) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n",
  "id": "MAL-2026-18436",
  "modified": "2026-11-02T02:30:05.124308757Z",
  "published": "2026-11-01T10:15:35Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://rubygems.org/gems/macs-shoaibs-pro17/versions/90002.1"
    }
  ],
  "schema_version": "1.9.2",
  "summary": "Malicious code in macs-shoaibs-pro17 (RubyGems)"
}