MAL-2026-18599

    Dashboard / Malicious Package / MAL-2026-18599

    MAL-2026-18599

    Published: 4 Nov 2026Last Modified: 4 Nov 2026

    Summary: Malicious code in w002yardprobe (RubyGems)

    Details: Source: amazon-inspector (721580f8eda44ad5ee7604f5ba0648e8830302f784e3e4a995e02ca7359c909e) The gem ships a `.yardopts` file containing `--load./script.rb`, which causes YARD to execute `script.rb` whenever documentation is generated for the gem (locally via `yard doc`, in CI, or on doc-hosting services such as RubyDoc.info). `script.rb` collects host identifiers — `Socket.gethostname`, current working directory, UID, and `RUBY_VERSION` — and POSTs them via `Net::HTTP.post_form` to the hardcoded third-party collector `https://webhook.site/97fa3c6a-3fad-4d2d-8312-15dc37e41e66`. The same script also rewrites `lib/w002yardprobe.rb` in place (substituting a `MARKSLOT` token with a runtime stamp) and drops sentinel files `W002SCRIPT_RAN.txt` and `W002EGRESS_OK.txt` in the detected build directory (e.g. `/build`), indicating the gem is instrumented to probe a documentation-build sandbox. The package self-identifies as a probe; the exfiltration and build-environment mutation are the gem's purpose. The trigger is YARD doc generation rather than `gem install` or `require`, so the harm materializes against whichever host (developer workstation, CI runner, or doc-hosting pipeline) processes the gem's documentation.

    References: https://rubygems.org/gems/w002yardprobe/versions/0.0.4, https://rubygems.org/gems/w002yardprobe/versions/0.0.5

    Affected packages

    Package

    Name: w002yardprobe

    Purl: pkg:gem/w002yardprobe

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.0.4
    0.0.5