Malicious code in donjon-ledger (RubyGems)
MAL-2026-18765
Published · Modified
Dependency scanning
Check whether donjon-ledger is in your codebase
Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.
Description
__
Source: amazon-inspector (4ab38ebb03685b0ddfa31074b056e0a95da764170efe3026ed822ff7c8b3c247)
The gemspec declares ext/mkrf_conf.rb as a native extension, causing it to execute automatically during gem install. The script ships no C/C++/Rust sources and performs no build work. Instead it collects host identifiers (hostname, username) and reads /etc/passwd, /etc/hosts, and /etc/resolv.conf, then opens a TLS connection to the hardcoded Burp Collaborator subdomain 8enejtlpqb2m1fzcaieyzjgv3m9mxcl1.oastify.com on port 443 and POSTs the collected JSON. A DNS lookup to the same subdomain is also performed. The script writes a.installed marker and exits. The extension hook exists solely as an install-time execution vector for this exfiltration payload.
References
Ready to move
Start Securing
Free, no credit card | First findings in minutes