Malicious code in brida-frida-hooks (RubyGems)
MAL-2026-18598
Published · Modified
Dependency scanning
Check whether brida-frida-hooks is in your codebase
Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.
Description
__
Source: amazon-inspector (cc383ba7728e9aec64324ce8b1c9b354b0331d7c404888e39d1d127885381e1d)
The gem declares an extension script in its gemspec that executes during gem install. On install, the script collects installer identity and local system data — current working directory, home directory, hostname, username, and the contents of /etc/resolv.conf, /etc/passwd, and /etc/hosts — and POSTs them over TLS via a raw TCPSocket to the hardcoded Burp Collaborator subdomain bjyhowqsve7p6i4fflj14mly8pel2bq0.oastify.com on port 443. The exfiltration is unrelated to the gem's stated 'simple demo' purpose and runs automatically on default install.
References
Ready to move
Start Securing
Free, no credit card | First findings in minutes