brida-frida-hooks 1.0.1

phone-homeCovers 1.0.1Reviewed by BitbisonUpdated 2026-11-06

The gemspec declares ext/mkrf_conf.rb as an extension, so gem install runs it; it reads /etc/passwd, /etc/hosts and /etc/resolv.conf and sends them with the user and hostname over TLS to bjyhowqsve7p6i4fflj14mly8pel2bq0.oastify.com.

On November 3, 2026, brida-frida-hooks 1.0.1 was published to RubyGems by "Shoaib" as "A simple gem for demonstration purposes". It was the gem's only release. Its specification declares an extension script, ext/mkrf_conf.rb, which RubyGems runs on install. The script reads the machine's /etc/passwd, /etc/hosts and /etc/resolv.conf and, by OSV's account, sends them with the installing user's name, home directory, working directory and hostname to bjyhowqsve7p6i4fflj14mly8pel2bq0.oastify.com, a Burp Collaborator address. OSV lists it as MAL-2026-18598. RubyGems has since yanked the gem.

What brida-frida-hooks does

Installing brida-frida-hooks 1.0.1 (brida-frida-hooks-1.0.1.gem, sha256 1e8d10741693dd0bd6b50e5102cdc17891ce8f0e11ebb3fb1c08e388e0fc4f17) with a plain gem install does this:

• RubyGems unpacks the gem's two files, ext/mkrf_conf.rb and lib/brida/frida/hooks.rb, and starts ruby mkrf_conf.rb in the gem's ext directory as the gem's extension. The gem has no native code to compile.
• mkrf_conf.rb reads /etc/resolv.conf, /etc/passwd and /etc/hosts. It resolves bjyhowqsve7p6i4fflj14mly8pel2bq0.oastify.com and opens a TLS connection to it, at 54.77.139.23 on port 443, and writes to it.
• It then creates lib/.installed in the gem's directory and exits. RubyGems starts rake in ext next. By then the data has already been sent.
• The script starts no other process, creates nothing else and connects to no other host.

What the code does

The gem's specification, brida-frida-hooks.gemspec in the published archive (sha256 6e6dec43ce3455df599f0c55547ba69e311b303c9dde474eecf2f8a8e0766e34, 21 lines), is what makes the script run:

• Line 15, s.extensions = ["ext/mkrf_conf.rb"], and line 3, # stub: ext/mkrf_conf.rb, declare the script as the gem's only extension. RubyGems hands any extension file whose name contains mkrf_conf to its rake builder, which runs the file with ruby and then runs rake. So the script runs on every default gem install, and on every bundle install that pulls the gem in, before any of the gem's code is required.
• Line 16, s.files = ["ext/mkrf_conf.rb", "lib/brida/frida/hooks.rb"], lists only those two files. There is no C source, extconf.rb or Rakefile, so the extension compiles nothing. It exists only so that mkrf_conf.rb is executed.
• Lines 11–14 and 17–20 give the author as "Shoaib" with the placeholder address shoaib@example.com. The summary and description are "A simple gem" and "A simple gem for demonstration purposes", and the homepage, https://rubygems.org/gems/shoaib, is not this gem's page. The specification declares no dependencies, no executables and no post-install message.

The script itself is not in the specification. The OSV report gives ext/mkrf_conf.rb the sha256 4baeb968680755ee32092bff70514a250fb6a0850f4d2b4aced73be7cf97640c. It says the script collects the current working directory, the home directory, the hostname, the username and the contents of /etc/resolv.conf, /etc/passwd and /etc/hosts, and POSTs them over TLS through a raw TCPSocket to bjyhowqsve7p6i4fflj14mly8pel2bq0.oastify.com on port 443. The file reads and the connection described above match that account. The fields sent and the use of POST rest on OSV's report.

oastify.com is the public domain of Burp Collaborator, a service that receives requests sent by a probe. Each subdomain belongs to one Collaborator user, who sees every request that reaches it. The gem's name is that of a Burp extension for Frida. The data identifies who installed the gem and on what machine: the user, the host, the working directory (on a CI runner, the checkout path), the local accounts, the DNS resolvers and search domains, and any internal names in /etc/hosts. Neither OSV's account nor the files the script reads include credential files or environment secrets. The specification installs nothing that persists, and the script leaves only the empty marker lib/.installed. That fits a dependency-confusion or penetration-test probe. Even so, a probe like this sends internal details about the installing machine to a third party without asking.

Timeline (UTC)

If you installed it

Run gem list but also check install logs and Gemfile.lock files for the name, because an install that failed may still have sent the data. Delete any brida-frida-hooks-1.0.1 directory left under your gem path. Treat the machine's hostname, the installing user, the working and home directories, and the contents of /etc/passwd, /etc/hosts and /etc/resolv.conf as known to whoever owns the Collaborator address. No credentials are taken. If the gem was installed on a CI runner or on a host with internal names in /etc/hosts, tell whoever runs that network. Block bjyhowqsve7p6i4fflj14mly8pel2bq0.oastify.com, and *.oastify.com if nothing you run uses Burp Collaborator. If you use a private gem source with a gem of the same name, make sure your Gemfile pins that source so the public gem cannot be picked up instead.

Links

• OSV MAL-2026-18598
• OpenSSF malicious-packages report