intercom-react-native-example-e2e-tests

maliciousCovers 1.0.1Reviewed by BitbisonUpdated 2026-11-02

The gem's install-time extension collects /etc/passwd, /etc/hosts, /etc/resolv.conf, the hostname, user and paths, and POSTs them to 4diaipklp71i0by89eduyffr2i8dw3ks.oastify.com.

What the analysis saw

The registry's build of intercom-react-native-example-e2e-tests@1.0.1 (build ef0ddebc-4c12-445f-9f5e-5174f4bf11f9) flagged its install: while gem install ran the gem's extension script, /usr/bin/ruby3.3 mkrf_conf.rb resolved and connected to 4diaipklp71i0by89eduyffr2i8dw3ks.oastify.com:443, a request-capture service, and sent data to it. Nothing the build compiled, linked or ran came from that host.

What the code does

ext/mkrf_conf.rb, declared as the gem's extension so that RubyGems runs it at install, before anything requires the gem:

• looks up 4diaipklp71i0by89eduyffr2i8dw3ks.oastify.com (a DNS callback);
• collects the working directory, the home directory, the hostname, the login name, and the full contents of /etc/passwd, /etc/hosts and /etc/resolv.conf;
• POSTs them as JSON over TLS to https://4diaipklp71i0by89eduyffr2i8dw3ks.oastify.com/, tagged my_shoaib;
• discards every error, then writes lib/.installed.

The library itself is an empty module stub. The gem's summary is "A simple gem"; its metadata names no source. The owner (testneo378) published two gems with the same script on the same day, each with its own collector host.

OpenSSF Package Analysis reported this release as malicious (MAL-2026-18462).

Conclusion

malicious: installing the gem sends the machine's account list, host and resolver configuration, and identity to an attacker's request-capture host, undisclosed.

Links

• RubyGems page
• OpenSSF malicious-packages MAL-2026-18462