control-character-command-injection 1.0.1

control-character-command-injection 1.0.1 is a RubyGems gem published by the account dawood7175 on 2026-11-05 at 16:54 UTC. Installing it runs an install script that connects to a Burp Collaborator interaction host, xuv3zi1e60ibh4f1q7unf8wkjbpad01p.oastify.com, and sends it a request: the machine that installed the gem reports itself to a server run by whoever registered that host. Bitbison identified it at 16:59 UTC, less than five minutes after it was published. It was yanked from RubyGems between 17:01 and 17:04 UTC, under ten minutes after it was published. Copies installed in that window, and any mirror or cache that kept it, still run it on install.

What control-character-command-injection does

Nothing useful. Its gemspec describes it as "A simple gem for demonstration purposes", names the author "Shoaib" with the address shoaib@example.com, points its homepage at a different gem's page, and ships two files: lib/control/character/command/injection.rb and an install script, ext/mkrf_conf.rb, declared as its native extension so that RubyGems runs it on every install. The account has published no other gem and no repository.

What the code does

• ext/mkrf_conf.rb is run by Ruby during gem install, as every extension script is.
• It reads /etc/resolv.conf, /etc/hosts, /etc/nsswitch.conf and /etc/passwd, resolves xuv3zi1e60ibh4f1q7unf8wkjbpad01p.oastify.com, and opens an HTTPS connection to it (Burp Collaborator's public interaction service, 3.248.33.252:443 at the time), writing a request and reading the reply.
• It then creates lib/.installed in the gem's directory and exits; the whole script runs in about half a second, and the install completes as normal.
• What the request carried is not visible from outside the TLS connection, and the script's own text is no longer published, since the gem was removed. An interaction host exists to record who contacted it: at the least, the installing machine's address and the time of install.

Timeline (UTC)

If you installed it

Remove it (gem uninstall control-character-command-injection) and look for lib/.installed under its directory in your gem paths. Treat the machine that installed it as having reported itself to a third party; check it for anything else run at that time, and block *.oastify.com and *.burpcollaborator.net from CI and production hosts if you have no use for them.