donjon-ledger

{"modified":"2026-11-08T09:39:40Z","published":"2026-11-08T09:39:40Z","schema_version":"1.7.4","id":"MAL-2026-18765","summary":"Malicious code in donjon-ledger (RubyGems)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4ab38ebb03685b0ddfa31074b056e0a95da764170efe3026ed822ff7c8b3c247)\nThe gemspec declares ext/mkrf_conf.rb as a native extension, causing it to execute automatically during `gem install`. The script ships no C/C++/Rust sources and performs no build work. Instead it collects host identifiers (hostname, username) and reads /etc/passwd, /etc/hosts, and /etc/resolv.conf, then opens a TLS connection to the hardcoded Burp Collaborator subdomain 8enejtlpqb2m1fzcaieyzjgv3m9mxcl1.oastify.com on port 443 and POSTs the collected JSON. A DNS lookup to the same subdomain is also performed. The script writes a.installed marker and exits. The extension hook exists solely as an install-time execution vector for this exfiltration payload.\n","affected":[{"package":{"ecosystem":"RubyGems","name":"donjon-ledger"},"versions":["2.0.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"ext/mkrf_conf.rb","sha256":"4c10bfa03c6576b7f654145e4293a5f31a0256530d00fa3e2ac8879e99a746d7","tlsh":"2f1132c99384bdb06b57cc6ff24c205014a7d986c60669317b9948bccf6db2863719f5"},{"path":"metadata.yaml","sha256":"060ae8b062436436a1f42b9733a5a52062dea9a5cc687f3cdc84a58b31b4d800","tlsh":"4811bd80b6c7e47bf105d2e69c103307b3b2d50cbea638019a8bc2da43d556a3743261"}],"package_integrity":[{"filename":"donjon-ledger-2.0.2.gem","hashes":{"sha256":"2501fef0514d8321daddf561e5e3caf18bd09ed8136befe3a62b09681910dc9e"}}]}}}],"references":[{"type":"PACKAGE","url":"https://rubygems.org/gems/donjon-ledger/versions/2.0.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-022567","import_time":"2026-11-08T10:11:09.148169564Z","modified_time":"2026-11-08T09:39:40Z","sha256":"4ab38ebb03685b0ddfa31074b056e0a95da764170efe3026ed822ff7c8b3c247","source":"amazon-inspector","versions":["2.0.2"]}]}}