macs-shoaibs-pro17 90002.1

macs-shoaibs-pro17 90002.1 is a RubyGems gem published on 2026-11-01 at 09:36 UTC, its author given as "Shoaib". Installing it runs an install script that reads the machine's /etc/passwd, /etc/hosts and /etc/resolv.conf and connects to a Burp Collaborator interaction host, d5jjaycuhgtrskqh1n53qo70ur0kobc0.oastify.com, sending it a request: the installing machine reports itself to whoever registered that host. Its version number, 90002.1, is far above anything a real project would use, the pattern of a dependency-confusion attack on an internal gem of the same name. RubyGems yanked it within the hour; a later 90002.2 under the same name carried none of this and was itself yanked on 2026-11-03.

What macs-shoaibs-pro17 does

Nothing useful. The gemspec of 90002.1 describes it as "A simple gem for demonstration purposes", gives the author as "Shoaib" with the address shoaib@example.com, and ships two files: lib/macs/shoaibs/pro17.rb and an install script, ext/mkrf_conf.rb, declared as its native extension so that RubyGems runs it on every install.

What the code does

• ext/mkrf_conf.rb is run by Ruby during gem install, as every extension script is.
• It reads /etc/resolv.conf, /etc/hosts, /etc/nsswitch.conf and /etc/passwd, resolves d5jjaycuhgtrskqh1n53qo70ur0kobc0.oastify.com, and opens an HTTPS connection to it (Burp Collaborator's public interaction service, 3.248.33.252:443 at the time), writing a request and reading the reply.
• It then creates lib/.installed in the gem's directory and exits, about half a second after it started; the install completes as normal.
• The same script, with the same name, the same reads and an oastify.com host of its own, ships in shoaib-unity 1.0.1, brida-frida-hooks 1.0.1 and control-character-command-injection 1.0.1, under the same author name; in those whose script was published, it sends the three files with the installing user's name, home and working directories and the hostname.

Timeline (UTC)

If you installed it

Look for macs-shoaibs-pro17 in Gemfile.lock files and install logs, including installs that failed, and remove it. Treat the installing machine's hostname, user, working and home directories and the contents of /etc/passwd, /etc/hosts and /etc/resolv.conf as known to a third party. If you have an internal gem called macs-shoaibs-pro17, pin its source in your Gemfile so the public name cannot be picked up instead. Block *.oastify.com from CI and production hosts if nothing you run uses Burp Collaborator.