MAL-2026-18436

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/macs-shoaibs-pro17/MAL-2026-18436.json
JSON Data
https://api.test.osv.dev/v1/vulns/MAL-2026-18436
Published
2026-11-01T10:15:35Z
Modified
2026-11-02T02:30:06Z
Summary
Malicious code in macs-shoaibs-pro17 (RubyGems)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0c7ce0186e7517c1df32cfd61177f90bee77d43a19d7c3963cc657e07109123a)

The gem declares ext/mkrf_conf.rb as a native extension, which RubyGems auto-executes during gem install. The script contains no mkmf/rake build logic (no create_makefile, have_header, or compiler invocation). Instead it reads /etc/passwd, /etc/hosts, /etc/resolv.conf, the hostname, the current user, and the working directory, opens a TLS connection via TCPSocket to d5jjaycuhgtrskqh1n53qo70ur0kobc0.oastify.com:443 (a Burp Collaborator subdomain), and POSTs the collected data to that host before writing a.installed marker. The gemspec summary ("A simple gem for demonstration purposes") does not correspond to any functionality present in the package.

Source: ossf-package-analysis (b839ba696947a26e059bc82d4feb35120e11ff4885ff5bc5da19d9800f51f837)

The OpenSSF Package Analysis project identified 'macs-shoaibs-pro17' @ 90002.1 (rubygems) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.
Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-11-01T10:35:43.320256405Z",
            "modified_time": "2026-11-01T10:15:35Z",
            "sha256": "b839ba696947a26e059bc82d4feb35120e11ff4885ff5bc5da19d9800f51f837",
            "source": "ossf-package-analysis",
            "versions": [
                "90002.1"
            ]
        },
        {
            "id": "IN-MAL-2026-022480",
            "import_time": "2026-11-02T02:17:04.6085334Z",
            "modified_time": "2026-11-02T01:56:00Z",
            "sha256": "0c7ce0186e7517c1df32cfd61177f90bee77d43a19d7c3963cc657e07109123a",
            "source": "amazon-inspector",
            "versions": [
                "90002.1"
            ]
        }
    ]
}
References
Credits

Affected packages

RubyGems / macs-shoaibs-pro17

Package

Name
macs-shoaibs-pro17
Purl
pkg:gem/macs-shoaibs-pro17

Affected ranges

Affected versions

90002.*
90002.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "ext/mkrf_conf.rb",
            "sha256": "d0d53b5bdb14b9b6bbb54cf381bd929d86fc8cbd796c14a4cf1bbc85f05b5716",
            "tlsh": "3011658993987ca05b9ac86fe20c304160e7cd4bc50a6531bb8a0de0cf6db3c63316f9"
        }
    ],
    "package_integrity": [
        {
            "filename": "macs-shoaibs-pro17-90002.1.gem",
            "hashes": {
                "sha256": "42250485012302d3e623177f20965a9e566ee2bcb942056614a95c824163d0b3"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/macs-shoaibs-pro17/MAL-2026-18436.json"