mal-2026-18598

{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "ext/mkrf_conf.rb",
              "sha256": "4baeb968680755ee32092bff70514a250fb6a0850f4d2b4aced73be7cf97640c",
              "tlsh": "8f111f8c9785bc759b5384bf960c30402493da8ac60925b4fbaa44b48f6db3c63314f6"
            }
          ],
          "package_integrity": [
            {
              "filename": "brida-frida-hooks-1.0.1.gem",
              "hashes": {
                "sha256": "1e8d10741693dd0bd6b50e5102cdc17891ce8f0e11ebb3fb1c08e388e0fc4f17"
              }
            }
          ]
        },
        "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/brida-frida-hooks/MAL-2026-18598.json"
      },
      "package": {
        "ecosystem": "RubyGems",
        "name": "brida-frida-hooks",
        "purl": "pkg:gem/brida-frida-hooks"
      },
      "versions": [
        "1.0.1"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-022532",
        "import_time": "2026-11-04T03:13:45.985285913Z",
        "modified_time": "2026-11-04T02:57:49Z",
        "sha256": "cc383ba7728e9aec64324ce8b1c9b354b0331d7c404888e39d1d127885381e1d",
        "source": "amazon-inspector",
        "versions": [
          "1.0.1"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (cc383ba7728e9aec64324ce8b1c9b354b0331d7c404888e39d1d127885381e1d)\nThe gem declares an extension script in its gemspec that executes during `gem install`. On install, the script collects installer identity and local system data — current working directory, home directory, hostname, username, and the contents of /etc/resolv.conf, /etc/passwd, and /etc/hosts — and POSTs them over TLS via a raw TCPSocket to the hardcoded Burp Collaborator subdomain bjyhowqsve7p6i4fflj14mly8pel2bq0.oastify.com on port 443. The exfiltration is unrelated to the gem's stated 'simple demo' purpose and runs automatically on default install.\n",
  "id": "MAL-2026-18598",
  "modified": "2026-11-04T03:30:03.366059014Z",
  "published": "2026-11-04T02:57:49Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://rubygems.org/gems/brida-frida-hooks/versions/1.0.1"
    }
  ],
  "schema_version": "1.9.2",
  "summary": "Malicious code in brida-frida-hooks (RubyGems)"
}