intercom-react-native-example-e2e-tests

{"schema_version":"1.7.4","id":"MAL-2026-18462","published":"2026-11-02T10:25:43Z","modified":"2026-11-02T21:12:31.985427768Z","summary":"Malicious code in intercom-react-native-example-e2e-tests (RubyGems)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (57e084aff68cdd6201d55d3375bbc29f6e741553d4ac083f910fc38e110ef3d1)\nThe gem declares `ext/mkrf_conf.rb` as an extension script, so it runs automatically on `gem install`. The script collects host reconnaissance data (hostname, username, current working directory, home directory) and reads sensitive local files (`/etc/resolv.conf`, `/etc/passwd`, `/etc/hosts`), serializes them as JSON, and transmits them over a TLS TCP socket to the hardcoded host `4diaipklp71i0by89eduyffr2i8dw3ks.oastify.com` (a Burp Collaborator / OAST subdomain). A DNS lookup to the same host is issued as an out-of-band beacon, and the payload is tagged with an identifier (`my_shoaib`) to track successful landings. The package name mimics an unrelated JavaScript project (`intercom-react-native`), ships only an empty library module, and uses placeholder author metadata — consistent with a dependency-confusion / name-squat probe whose only functional behavior is the install-time exfiltration.\n\n## Source: ossf-package-analysis (f17f130fc5b4fa9192f15a6e914928336f4e591d424b5bec8696923519d2793f)\nThe OpenSSF Package Analysis project identified 'intercom-react-native-example-e2e-tests' @ 1.0.1 (rubygems) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","affected":[{"package":{"name":"intercom-react-native-example-e2e-tests","ecosystem":"RubyGems"},"versions":["1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"ext/mkrf_conf.rb","sha256":"2eafe0ec8349008c90faf403997ad10c53fc7880d1d5794bd37225ef2d51e7d3","tlsh":"8011028957497d60ab92886fe54c208064a3dd6ac605a924bf9804a4cf6db6c23209fb"},{"path":"metadata.yaml","sha256":"73c1b27f19dcad5cefcfa1107f954d76c6d85b2fe53c8e3f5af8ac6d809ea290","tlsh":"9711ab80b6c3e8bbf501d2e64c503247f373d81cbea539019acbc1a543d556a3747265"}],"package_integrity":[{"filename":"intercom-react-native-example-e2e-tests-1.0.1.gem","hashes":{"sha256":"5151e3903b57de70ca7478bbc13132f375f0227d70f9bb51a7ad4d3e21fa170a"}}]}}}],"references":[{"type":"PACKAGE","url":"https://rubygems.org/gems/intercom-react-native-example-e2e-tests/versions/1.0.1"}],"database_specific":{"malicious-packages-origins":[{"import_time":"2026-11-02T10:37:06.610574735Z","modified_time":"2026-11-02T10:25:43Z","sha256":"f17f130fc5b4fa9192f15a6e914928336f4e591d424b5bec8696923519d2793f","source":"ossf-package-analysis","versions":["1.0.1"]},{"id":"IN-MAL-2026-022482","import_time":"2026-11-02T21:10:54.389271988Z","modified_time":"2026-11-02T20:55:37Z","sha256":"57e084aff68cdd6201d55d3375bbc29f6e741553d4ac083f910fc38e110ef3d1","source":"amazon-inspector","versions":["1.0.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}