dynamic-object-handler 1.0.1

dynamic-object-handler is a Ruby gem published on RubyGems under the owner dawood7175. When the gem is installed, RubyGems runs the gem's extension script ext/mkrf_conf.rb, and that script does more than set the gem up: it reads the host's user list and name-resolution files and opens a TLS connection to a Burp Collaborator out-of-band listener host. The gem and its versions have since been removed from RubyGems, so its published text is no longer available to quote; the behaviour below is what the script does when it runs.

What dynamic-object-handler does

The gem ships a library under lib/dynamic/object/handler.rb and an extension script ext/mkrf_conf.rb. On installation the extension script loads Ruby's socket, openssl, securerandom, resolv and etc libraries, reads /etc/passwd, /etc/hosts, /etc/resolv.conf and /etc/nsswitch.conf, then opens an outbound TLS connection to unl0sfubzxb8a18yj4nk85phc8i66wul.oastify.com on port 443 and sends data over it. oastify.com is the Burp Collaborator out-of-band interaction service; a unique subdomain such as this one is an attacker's private listener, and there is no ordinary reason for a gem's install script to contact one.

What the code does

• ext/mkrf_conf.rb: the gem's extension script; when it runs it reads the host's user list and name-resolution files and then connects to unl0sfubzxb8a18yj4nk85phc8i66wul.oastify.com:443 and transmits data. The package's text is no longer published on RubyGems, so the exact lines cannot be quoted, and the content of the TLS connection cannot be seen from outside; the reads and the connection are what the script's execution shows.
• lib/dynamic/object/handler.rb: the gem's ordinary library file, written into the installed gem alongside the extension script.

Timeline (UTC)

If you installed it

Remove the gem and treat any machine it was installed on as potentially having had its user list and host details sent to the publisher's listener. Check for other gems from the same owner, and inspect anything else installed around the same time.