MAL-2026-18462

Dashboard / Malicious Package / MAL-2026-18462

MAL-2026-18462

Summary: Malicious code in intercom-react-native-example-e2e-tests (RubyGems)

Details: Source: amazon-inspector (57e084aff68cdd6201d55d3375bbc29f6e741553d4ac083f910fc38e110ef3d1) The gem declares `ext/mkrf_conf.rb` as an extension script, so it runs automatically on `gem install`. The script collects host reconnaissance data (hostname, username, current working directory, home directory) and reads sensitive local files (`/etc/resolv.conf`, `/etc/passwd`, `/etc/hosts`), serializes them as JSON, and transmits them over a TLS TCP socket to the hardcoded host `4diaipklp71i0by89eduyffr2i8dw3ks.oastify.com` (a Burp Collaborator / OAST subdomain). A DNS lookup to the same host is issued as an out-of-band beacon, and the payload is tagged with an identifier (`my_shoaib`) to track successful landings. The package name mimics an unrelated JavaScript project (`intercom-react-native`), ships only an empty library module, and uses placeholder author metadata — consistent with a dependency-confusion / name-squat probe whose only functional behavior is the install-time exfiltration. Source: ossf-package-analysis (f17f130fc5b4fa9192f15a6e914928336f4e591d424b5bec8696923519d2793f) The OpenSSF Package Analysis project identified 'intercom-react-native-example-e2e-tests' @ 1.0.1 (rubygems) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

References: https://rubygems.org/gems/intercom-react-native-example-e2e-tests/versions/1.0.1