Skip to content
Open-Source Registry

gem / intercom-react-native-example-e2e-tests / 1.0.1

intercom-react-native-example-e2e-tests 1.0.1

bitbison: no public build not built
processes
147
operations
2.7K
packages
0
compiler runs
0
connections
1
build time
1s
job time
1s
capture
50 KB
records
4.7K
bytes / record
10.6
run de26dfa0-16eb-4a2c-a773-4d759c4096e3 · built 2026-11-02 · complete
Reviewed by Bitbison: maliciousThe gem's install-time extension collects /etc/passwd, /etc/hosts, /etc/resolv.conf, the hostname, user and paths, and POSTs them to 4diaipklp71i0by89eduyffr2i8dw3ks.oastify.com.

This release did not build; nothing below stands for the package.

Graph

egress · high
2

Checks

8 of 10 clear · 1 not checked Network activity
Build behavior▲✓✓✓✓✓✓✓
Supply chain○
Pipeline✓

Detections

1
  • Build script connected to a request-capture service: 4diaipklp71i0by89eduyffr2i8dw3ks.oastify.com:443
    intercom-react-native-example-e2e-tests 1.0.1 › 4diaipklp71i0by89eduyffr2i8dw3ks.oastify.com:443
    high

Detection

highwitnessed

Build script connected to a request-capture service: 4diaipklp71i0by89eduyffr2i8dw3ks.oastify.com:443

Unexpected network connection

Subject
intercom-react-native-example-e2e-tests 1.0.1
Destination
4diaipklp71i0by89eduyffr2i8dw3ks.oastify.com:443
Jobs
install-require
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to 4diaipklp71i0by89eduyffr2i8dw3ks.oastify.com:443, opened by ruby3.3

    subject 4diaipklp71i0by89eduyffr2i8dw3ks.oastify.com:443

    by /usr/bin/ruby3.3 mkrf_conf.rb

  2. What a build script's fetch becamesupport

    1 file came down; nothing the build compiled, linked or ran

  3. Connection opened by a build script or child processsupport

    the opener is the build script at /usr/bin/ruby3.3 mkrf_conf.rb

  4. What kind of service the host issupport

    4diaipklp71i0by89eduyffr2i8dw3ks.oastify.com:443: Burp Collaborator

What came before it

Loading the graph

Processes

install-require

env›ruby›ruby3.3

Ran
/usr/bin/ruby3.3 mkrf_conf.rb
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/intercom-react-native-example-e2e-tests-1.0.1.gem
Lineage · 3 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/intercom-react-native-example-e2e-tests-1.0.1.gem2531
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/intercom-react-native-example-e2e-tests-1.0.1.gem2533
  3. ruby3.3/usr/bin/ruby3.3 mkrf_conf.rb2544

Remediation

A dependency's build connected to a service build code has no use for: one that records what is sent to it, forwards it elsewhere, or delivers it to people. Review what the build could read and send, rotate any credential it could reach, and pin or replace the dependency.

Network

1 peers
  • 4diaipklp71i0by89eduyffr2i8dw3ks.oastify.com:443 intercom-react-native-example-e2e-tests's own build code · ruby3.3 · Amazon.com, Inc. · 1 file undeclared
Versions1RiskVulnsPublished
1.0.1did not build9h ago

Raw data

capture
50 KB
records
4,715
bytes per record
10.6

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: install-require failure · Generated 2026-11-02 · run de26dfa0-16eb-4a2c-a773-4d759c4096e3

analysis 0.1.0 · 2026-11-02 · a8bbe26 · graph v2

Sends /etc/passwd, host and resolver config to a request-capture host at install (dependency-confusion name)

maliciousCovers 1.0.1Reviewed by BitbisonUpdated 2026-11-02

The gem's install-time extension collects /etc/passwd, /etc/hosts, /etc/resolv.conf, the hostname, user and paths, and POSTs them to 4diaipklp71i0by89eduyffr2i8dw3ks.oastify.com.

What the analysis saw

The registry's build of intercom-react-native-example-e2e-tests@1.0.1 (build ef0ddebc-4c12-445f-9f5e-5174f4bf11f9) flagged its install: while gem install ran the gem's extension script, /usr/bin/ruby3.3 mkrf_conf.rb resolved and connected to 4diaipklp71i0by89eduyffr2i8dw3ks.oastify.com:443, a request-capture service, and sent data to it. Nothing the build compiled, linked or ran came from that host.

What the code does

ext/mkrf_conf.rb, declared as the gem's extension so that RubyGems runs it at install, before anything requires the gem:

  • looks up 4diaipklp71i0by89eduyffr2i8dw3ks.oastify.com (a DNS callback);
  • collects the working directory, the home directory, the hostname, the login name, and the full contents of /etc/passwd, /etc/hosts and /etc/resolv.conf;
  • POSTs them as JSON over TLS to https://4diaipklp71i0by89eduyffr2i8dw3ks.oastify.com/, tagged my_shoaib;
  • discards every error, then writes lib/.installed.

The library itself is an empty module stub. The gem's summary is "A simple gem"; its metadata names no source. The owner (testneo378) published two gems with the same script on the same day, each with its own collector host.

OpenSSF Package Analysis reported this release as malicious (MAL-2026-18462).

Conclusion

malicious: installing the gem sends the machine's account list, host and resolver configuration, and identity to an attacker's request-capture host, undisclosed.

Indicators

hosts
4diaipklp71i0by89eduyffr2i8dw3ks.oastify.com

Examined

1.0.1
sha256:5151e3903b57de70ca7478bbc13132f375f0227d70f9bb51a7ad4d3e21fa170a

Links