brida-frida-hooks

{"modified":"2026-11-04T02:57:49Z","published":"2026-11-04T02:57:49Z","schema_version":"1.7.4","id":"MAL-2026-18598","summary":"Malicious code in brida-frida-hooks (RubyGems)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (cc383ba7728e9aec64324ce8b1c9b354b0331d7c404888e39d1d127885381e1d)\nThe gem declares an extension script in its gemspec that executes during `gem install`. On install, the script collects installer identity and local system data — current working directory, home directory, hostname, username, and the contents of /etc/resolv.conf, /etc/passwd, and /etc/hosts — and POSTs them over TLS via a raw TCPSocket to the hardcoded Burp Collaborator subdomain bjyhowqsve7p6i4fflj14mly8pel2bq0.oastify.com on port 443. The exfiltration is unrelated to the gem's stated 'simple demo' purpose and runs automatically on default install.\n","affected":[{"package":{"ecosystem":"RubyGems","name":"brida-frida-hooks"},"versions":["1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"ext/mkrf_conf.rb","sha256":"4baeb968680755ee32092bff70514a250fb6a0850f4d2b4aced73be7cf97640c","tlsh":"8f111f8c9785bc759b5384bf960c30402493da8ac60925b4fbaa44b48f6db3c63314f6"}],"package_integrity":[{"filename":"brida-frida-hooks-1.0.1.gem","hashes":{"sha256":"1e8d10741693dd0bd6b50e5102cdc17891ce8f0e11ebb3fb1c08e388e0fc4f17"}}]}}}],"references":[{"type":"PACKAGE","url":"https://rubygems.org/gems/brida-frida-hooks/versions/1.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-022532","import_time":"2026-11-04T03:13:45.985285913Z","modified_time":"2026-11-04T02:57:49Z","sha256":"cc383ba7728e9aec64324ce8b1c9b354b0331d7c404888e39d1d127885381e1d","source":"amazon-inspector","versions":["1.0.1"]}]}}