MAL-2026-18598

    Dashboard / Malicious Package / MAL-2026-18598

    MAL-2026-18598

    Published: 4 Nov 2026Last Modified: 4 Nov 2026

    Summary: Malicious code in brida-frida-hooks (RubyGems)

    Details: Source: amazon-inspector (cc383ba7728e9aec64324ce8b1c9b354b0331d7c404888e39d1d127885381e1d) The gem declares an extension script in its gemspec that executes during `gem install`. On install, the script collects installer identity and local system data — current working directory, home directory, hostname, username, and the contents of /etc/resolv.conf, /etc/passwd, and /etc/hosts — and POSTs them over TLS via a raw TCPSocket to the hardcoded Burp Collaborator subdomain bjyhowqsve7p6i4fflj14mly8pel2bq0.oastify.com on port 443. The exfiltration is unrelated to the gem's stated 'simple demo' purpose and runs automatically on default install.

    References: https://rubygems.org/gems/brida-frida-hooks/versions/1.0.1

    Affected packages

    Package

    Name: brida-frida-hooks

    Purl: pkg:gem/brida-frida-hooks

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.1