gem / dynamic-object-handler

dynamic-object-handler 1.0.1

Riskhigh Vulnsnone

processes: 303
operations: 6.1K
packages: 0
compiler runs: 0
connections: 2
build time: 7s
job time: 7s
capture: 68 KB
records: 9.4K
bytes / record: 7.2

A simple gem

published 2026-11-05 · home page Release

Graph

egress · high

Checks

10 of 12 clear · 1 not checked Network activity

Build behavior▲✓✓✓✓✓✓✓✓✓

Supply chain○

Pipeline✓

Detections

Build script connected to a request-capture service: unl0sfubzxb8a18yj4nk85phc8i66wul.oastify.com:443

dynamic-object-handler 1.0.1 › unl0sfubzxb8a18yj4nk85phc8i66wul.oastify.com:443

high

Network

2 peers

unl0sfubzxb8a18yj4nk85phc8i66wul.oastify.com:443 dynamic-object-handler's own build code · ruby3.3 · Amazon.com, Inc. · 1 file undeclared
rubygems.org:443 the package manager · ruby3.3 · Fastly, Inc. ecosystem

Versions1

1 of 1 jobs captured: install-require failure · Generated 2026-11-05 · run 7a6ad389-332e-4dfc-856b-3e1fdafb9247

analysis 0.1.0 · 2026-11-04 · bfee307 · graph v2

dynamic-object-handler's install script beacons to a Burp Collaborator host

Conclusion: malicious
Covers: 1.0.1
Reviewed by: Bitbison
Updated: 2026-11-07

The gem's ext/mkrf_conf.rb install script reads host user data and connects to a Burp Collaborator out-of-band listener host during installation.

dynamic-object-handler is a Ruby gem published on RubyGems under the owner dawood7175. When the gem is installed, RubyGems runs the gem's extension script ext/mkrf_conf.rb, and that script does more than set the gem up: it reads the host's user list and name-resolution files and opens a TLS connection to a Burp Collaborator out-of-band listener host. The gem and its versions have since been removed from RubyGems, so its published text is no longer available to quote; the behaviour below is what the script does when it runs.

What dynamic-object-handler does

The gem ships a library under lib/dynamic/object/handler.rb and an extension script ext/mkrf_conf.rb. On installation the extension script loads Ruby's socket, openssl, securerandom, resolv and etc libraries, reads /etc/passwd, /etc/hosts, /etc/resolv.conf and /etc/nsswitch.conf, then opens an outbound TLS connection to unl0sfubzxb8a18yj4nk85phc8i66wul.oastify.com on port 443 and sends data over it. oastify.com is the Burp Collaborator out-of-band interaction service; a unique subdomain such as this one is an attacker's private listener, and there is no ordinary reason for a gem's install script to contact one.

What the code does

ext/mkrf_conf.rb: the gem's extension script; when it runs it reads the host's user list and name-resolution files and then connects to unl0sfubzxb8a18yj4nk85phc8i66wul.oastify.com:443 and transmits data. The package's text is no longer published on RubyGems, so the exact lines cannot be quoted, and the content of the TLS connection cannot be seen from outside; the reads and the connection are what the script's execution shows.
lib/dynamic/object/handler.rb: the gem's ordinary library file, written into the installed gem alongside the extension script.

Timeline (UTC)

When	What
on or before 2026-11-05	version 1.0.1 published to RubyGems
2026-11-07	no longer served by RubyGems (the gem page shows the version as yanked)

If you installed it

Remove the gem and treat any machine it was installed on as potentially having had its user list and host details sent to the publisher's listener. Check for other gems from the same owner, and inspect anything else installed around the same time.

Indicators

hosts: unl0sfubzxb8a18yj4nk85phc8i66wul.oastify.com
files: ext/mkrf_conf.rb
processes: ruby3.3 mkrf_conf.rb

What was examined

1.0.1: sha256:f02d3b66a557def0365db56439cc40239eccacb1f2d728a1cb876726002b0177