agentic-call-control

{"modified":"2026-11-08T09:39:55Z","published":"2026-11-08T09:39:55Z","schema_version":"1.7.4","id":"MAL-2026-18763","summary":"Malicious code in agentic-call-control (RubyGems)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6604e2b2afca5be9f394786598898c0d718100ef3cb3595590fb74949b3eb9b5)\nThe gem's native extension script executes during `gem install` and harvests installer-side data without consent. It collects host identifiers (current working directory, home directory, hostname, login name) and reads the contents of `/etc/resolv.conf`, `/etc/passwd`, and `/etc/hosts`, serializes them as JSON, and POSTs the payload over TLS to the hardcoded host `k6rqb5d1inuytrro2u6arv87vy1vplda.oastify.com` on port 443 using `TCPSocket`/OpenSSL. A DNS lookup to the same subdomain is also issued as an out-of-band beacon. The destination is a Burp Collaborator subdomain — attacker-controlled out-of-band interaction infrastructure unrelated to any declared publisher or build dependency. There is no native source tree or build logic that would require this network activity; the extension script's sole effect on install is reconnaissance exfiltration.\n","affected":[{"package":{"ecosystem":"RubyGems","name":"agentic-call-control"},"versions":["1.1.8"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"ext/mkrf_conf.rb","sha256":"d440f744cf657b71a4705c14f00f9cffa1b7051e9177a1f62c27538eabdab7fa","tlsh":"dd11ef895395be60ab9bc5bfe60c20415493dd4ac50968b07a9e08a08f6dbac63315f6"}],"package_integrity":[{"filename":"agentic-call-control-1.1.8.gem","hashes":{"sha256":"8e7ed9a4c6b543ff1dc6898f580969da78b2790ec73762f78c1c6a7a5875b1ff"}}]}}}],"references":[{"type":"PACKAGE","url":"https://rubygems.org/gems/agentic-call-control/versions/1.1.8"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-022569","import_time":"2026-11-08T10:11:09.319492473Z","modified_time":"2026-11-08T09:39:55Z","sha256":"6604e2b2afca5be9f394786598898c0d718100ef3cb3595590fb74949b3eb9b5","source":"amazon-inspector","versions":["1.1.8"]}]}}