A dependency-confusion style gem whose install script reads /etc/passwd, /etc/hosts and /etc/resolv.conf and contacts an oastify.com interaction host on every install.
macs-shoaibs-pro17 90002.1 is a RubyGems gem published on 2026-11-01 at 09:36 UTC, its author given as "Shoaib". Installing it runs an install script that reads the machine's /etc/passwd, /etc/hosts and /etc/resolv.conf and connects to a Burp Collaborator interaction host, d5jjaycuhgtrskqh1n53qo70ur0kobc0.oastify.com, sending it a request: the installing machine reports itself to whoever registered that host. Its version number, 90002.1, is far above anything a real project would use, the pattern of a dependency-confusion attack on an internal gem of the same name. RubyGems yanked it within the hour; a later 90002.2 under the same name carried none of this and was itself yanked on 2026-11-03.
What macs-shoaibs-pro17 does
Nothing useful. The gemspec of 90002.1 describes it as "A simple gem for demonstration purposes", gives the author as "Shoaib" with the address shoaib@example.com, and ships two files: lib/macs/shoaibs/pro17.rb and an install script, ext/mkrf_conf.rb, declared as its native extension so that RubyGems runs it on every install.
What the code does
ext/mkrf_conf.rb is run by Ruby during gem install, as every extension script is.- It reads
/etc/resolv.conf, /etc/hosts, /etc/nsswitch.conf and /etc/passwd, resolves d5jjaycuhgtrskqh1n53qo70ur0kobc0.oastify.com, and opens an HTTPS connection to it (Burp Collaborator's public interaction service, 3.248.33.252:443 at the time), writing a request and reading the reply.
- It then creates
lib/.installed in the gem's directory and exits, about half a second after it started; the install completes as normal.
- The same script, with the same name, the same reads and an
oastify.com host of its own, ships in shoaib-unity 1.0.1, brida-frida-hooks 1.0.1 and control-character-command-injection 1.0.1, under the same author name; in those whose script was published, it sends the three files with the installing user's name, home and working directories and the hostname.
Timeline (UTC)
| When | What |
|---|
| 2026-11-01 09:36 | 90002.1 published to RubyGems |
| 2026-11-01 10:15–10:30 | 90002.1 yanked, under an hour after publication |
| 2026-11-01 10:43 | 90002.2 published under the same name, an ordinary gem skeleton with no install script |
| 2026-11-03 09:35–09:41 | 90002.2 yanked; RubyGems no longer serves the gem |
If you installed it
Look for macs-shoaibs-pro17 in Gemfile.lock files and install logs, including installs that failed, and remove it. Treat the installing machine's hostname, user, working and home directories and the contents of /etc/passwd, /etc/hosts and /etc/resolv.conf as known to a third party. If you have an internal gem called macs-shoaibs-pro17, pin its source in your Gemfile so the public name cannot be picked up instead. Block *.oastify.com from CI and production hosts if nothing you run uses Burp Collaborator.
