control-character-command-injection

{"modified":"2026-11-08T09:40:01Z","published":"2026-11-08T09:40:01Z","schema_version":"1.7.4","id":"MAL-2026-18764","summary":"Malicious code in control-character-command-injection (RubyGems)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (83327b9e45cb49b02f4a3681837f5acdc84f15373a85648f4409946e6fa72f75)\nThe gem declares an extension script in metadata.yaml that RubyGems executes during `gem install`. At install time the script reads host identifiers (hostname, username, current working directory, home directory) and the contents of /etc/resolv.conf, /etc/passwd, and /etc/hosts, then opens a TLS connection via TCPSocket to the Burp Collaborator subdomain xuv3zi1e60ibh4f1q7unf8wkjbpad01p.oastify.com on port 443 and POSTs the collected data as a JSON body. A DNS lookup to the same host is also performed. The destination is an out-of-band interaction host unrelated to any legitimate publisher infrastructure, and the behavior fires automatically on install without user interaction.\n","affected":[{"package":{"ecosystem":"RubyGems","name":"control-character-command-injection"},"versions":["1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"ext/mkrf_conf.rb","sha256":"2a41f40c24eb43e60a1ce005aa11b28063fbce37464f3a8180bc03e9f11d14ac","tlsh":"b11102889388bc715b53a46fdf0c204164d3d95ac60579357ad908b4cf6db3d23315fa"}],"package_integrity":[{"filename":"control-character-command-injection-1.0.1.gem","hashes":{"sha256":"da67d1bc1c6786405b35376deb6b65cf96ddbcc9b2fa5246423d789b34122a5e"}}]}}}],"references":[{"type":"PACKAGE","url":"https://rubygems.org/gems/control-character-command-injection/versions/1.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-022570","import_time":"2026-11-08T10:11:09.396682257Z","modified_time":"2026-11-08T09:40:01Z","sha256":"83327b9e45cb49b02f4a3681837f5acdc84f15373a85648f4409946e6fa72f75","source":"amazon-inspector","versions":["1.0.1"]}]}}