If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (0c7ce0186e7517c1df32cfd61177f90bee77d43a19d7c3963cc657e07109123a)
The gem declares ext/mkrf_conf.rb as a native extension, which RubyGems auto-executes during `gem install`. The script contains no mkmf/rake build logic (no create_makefile, have_header, or compiler invocation). Instead it reads /etc/passwd, /etc/hosts, /etc/resolv.conf, the hostname, the current user, and the working directory, opens a TLS connection via TCPSocket to d5jjaycuhgtrskqh1n53qo70ur0kobc0.oastify.com:443 (a Burp Collaborator subdomain), and POSTs the collected data to that host before writing a.installed marker. The gemspec summary ("A simple gem for demonstration purposes") does not correspond to any functionality present in the package.
Source: ossf-package-analysis (b839ba696947a26e059bc82d4feb35120e11ff4885ff5bc5da19d9800f51f837)
The OpenSSF Package Analysis project identified 'macs-shoaibs-pro17' @ 90002.1 (rubygems) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.