Malicious code in control-character-command-injection (RubyGems)
MAL-2026-18764
Published · Modified
Dependency scanning
Check whether control-character-command-injection is in your codebase
Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.
Description
__
Source: amazon-inspector (83327b9e45cb49b02f4a3681837f5acdc84f15373a85648f4409946e6fa72f75)
The gem declares an extension script in metadata.yaml that RubyGems executes during gem install. At install time the script reads host identifiers (hostname, username, current working directory, home directory) and the contents of /etc/resolv.conf, /etc/passwd, and /etc/hosts, then opens a TLS connection via TCPSocket to the Burp Collaborator subdomain xuv3zi1e60ibh4f1q7unf8wkjbpad01p.oastify.com on port 443 and POSTs the collected data as a JSON body. A DNS lookup to the same host is also performed. The destination is an out-of-band interaction host unrelated to any legitimate publisher infrastructure, and the behavior fires automatically on install without user interaction.
References
Ready to move
Start Securing
Free, no credit card | First findings in minutes