mal-2026-18462

{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "ext/mkrf_conf.rb",
              "sha256": "2eafe0ec8349008c90faf403997ad10c53fc7880d1d5794bd37225ef2d51e7d3",
              "tlsh": "8011028957497d60ab92886fe54c208064a3dd6ac605a924bf9804a4cf6db6c23209fb"
            },
            {
              "path": "metadata.yaml",
              "sha256": "73c1b27f19dcad5cefcfa1107f954d76c6d85b2fe53c8e3f5af8ac6d809ea290",
              "tlsh": "9711ab80b6c3e8bbf501d2e64c503247f373d81cbea539019acbc1a543d556a3747265"
            }
          ],
          "package_integrity": [
            {
              "filename": "intercom-react-native-example-e2e-tests-1.0.1.gem",
              "hashes": {
                "sha256": "5151e3903b57de70ca7478bbc13132f375f0227d70f9bb51a7ad4d3e21fa170a"
              }
            }
          ]
        },
        "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/intercom-react-native-example-e2e-tests/MAL-2026-18462.json"
      },
      "package": {
        "ecosystem": "RubyGems",
        "name": "intercom-react-native-example-e2e-tests",
        "purl": "pkg:gem/intercom-react-native-example-e2e-tests"
      },
      "versions": [
        "1.0.1"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    },
    {
      "contact": [
        "https://github.com/ossf/package-analysis",
        "https://openssf.slack.com/channels/package_analysis"
      ],
      "name": "OpenSSF: Package Analysis",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "import_time": "2026-11-02T10:37:06.610574735Z",
        "modified_time": "2026-11-02T10:25:43Z",
        "sha256": "f17f130fc5b4fa9192f15a6e914928336f4e591d424b5bec8696923519d2793f",
        "source": "ossf-package-analysis",
        "versions": [
          "1.0.1"
        ]
      },
      {
        "id": "IN-MAL-2026-022482",
        "import_time": "2026-11-02T21:10:54.389271988Z",
        "modified_time": "2026-11-02T20:55:37Z",
        "sha256": "57e084aff68cdd6201d55d3375bbc29f6e741553d4ac083f910fc38e110ef3d1",
        "source": "amazon-inspector",
        "versions": [
          "1.0.1"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (57e084aff68cdd6201d55d3375bbc29f6e741553d4ac083f910fc38e110ef3d1)\nThe gem declares `ext/mkrf_conf.rb` as an extension script, so it runs automatically on `gem install`. The script collects host reconnaissance data (hostname, username, current working directory, home directory) and reads sensitive local files (`/etc/resolv.conf`, `/etc/passwd`, `/etc/hosts`), serializes them as JSON, and transmits them over a TLS TCP socket to the hardcoded host `4diaipklp71i0by89eduyffr2i8dw3ks.oastify.com` (a Burp Collaborator / OAST subdomain). A DNS lookup to the same host is issued as an out-of-band beacon, and the payload is tagged with an identifier (`my_shoaib`) to track successful landings. The package name mimics an unrelated JavaScript project (`intercom-react-native`), ships only an empty library module, and uses placeholder author metadata — consistent with a dependency-confusion / name-squat probe whose only functional behavior is the install-time exfiltration.\n\n## Source: ossf-package-analysis (f17f130fc5b4fa9192f15a6e914928336f4e591d424b5bec8696923519d2793f)\nThe OpenSSF Package Analysis project identified 'intercom-react-native-example-e2e-tests' @ 1.0.1 (rubygems) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n",
  "id": "MAL-2026-18462",
  "modified": "2026-11-02T21:15:06.957726085Z",
  "published": "2026-11-02T10:25:43Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://rubygems.org/gems/intercom-react-native-example-e2e-tests/versions/1.0.1"
    }
  ],
  "schema_version": "1.9.2",
  "summary": "Malicious code in intercom-react-native-example-e2e-tests (RubyGems)"
}