Skip to content
Open-Source Registry

gem / resource_registry

resource_registry 109.0.22

bitbison: flagged, behavior flagged, dependencies clean, posture not checked, pipeline clean, 1 of 1 jobs captured RiskhighVulnsnone
processes
169
operations
5.0K
packages
2
compiler runs
0
connections
2
build time
6s
job time
6s
capture
58 KB
records
7.5K
bytes / record
7.7

PoC By H1d3_khan

782 downloads · published 2025-07-31 · home page
Reviewed by Bitbison: phone-homeBoth live versions read the machine's hostname at require time and send it in an HTTP request to a canarytokens.com URL, undisclosed: a dependency-confusion probe.

Graph

egress · high · install-require
3

Checks

11 of 12 clear Network activity
Build behavior▲✓✓✓✓✓✓
Supply chain✓✓✓✓
Pipeline✓

Detections

1
  • Connected to a request-capture service: zpv9mqi86ioo2avmp2d92t5lj.canarytokens.com:80
    zpv9mqi86ioo2avmp2d92t5lj.canarytokens.com:80 › zpv9mqi86ioo2avmp2d92t5lj.canarytokens.com:80
    high

Detection

highwitnessed

Connected to a request-capture service: zpv9mqi86ioo2avmp2d92t5lj.canarytokens.com:80

Unexpected network connection

Subject
zpv9mqi86ioo2avmp2d92t5lj.canarytokens.com:80
Destination
zpv9mqi86ioo2avmp2d92t5lj.canarytokens.com:80
Jobs
install-require, install-require
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    opened by ruby3.3

    subject zpv9mqi86ioo2avmp2d92t5lj.canarytokens.com:80

    by /usr/bin/ruby3.3 -e gem "resource_registry", "109.0.22"; require "resource_registry"

  2. What kind of service the host issupport

    DNS logging services

What came before it · install-require

Loading the graph

What came before it · install-require

Loading the graph

Processes

install-require

ruby›ruby3.3

Ran
/usr/bin/ruby3.3 -e gem "resource_registry", "109.0.22"; require "resource_registry"
Invoked by
ruby /home/runner/work/_temp/require.rb resource_registry 109.0.22
Lineage · 2 processes
  1. rubyruby /home/runner/work/_temp/require.rb resource_registry 109.0.222543
  2. ruby3.3/usr/bin/ruby3.3 -e gem "resource_registry", "109.0.22"; require "resource_registry"2550

install-require

ruby›ruby

Ran
/usr/bin/ruby app.rb
Invoked by
/usr/bin/ruby /usr/bin/bundle exec ruby app.rb
Lineage · 2 processes
  1. ruby/usr/bin/ruby /usr/bin/bundle exec ruby app.rb2577
  2. ruby/usr/bin/ruby app.rb2581

Remediation

Find the code that made the connection and what it sent. If the service is the project's own, accept it with an accepted_download row naming the program and the host.

Network

2 peers
  • zpv9mqi86ioo2avmp2d92t5lj.canarytokens.com:80 resource_registry's own build code · ruby3.3 · Amazon.com, Inc. undeclared
  • index.rubygems.org:443 the package manager · bundle via rubygems.org · Fastly, Inc. · 65 files ecosystem
Dependencies2Build behaviour
detonate-probe0.0.1
rack3.2.8
Versions2RiskVulnsPublished
109.0.22highnone2025-07-31
1.0.22not analyzed2025-07-31

Raw data

capture
58 KB
records
7,539
bytes per record
7.7

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: install-require success · Generated 2026-11-02 · run 9618e3c0-9f8e-4ea2-baee-8e273a5c5365

analysis 0.1.0 · 2026-11-02 · 4ddffd1 · graph v2

Sends the host's name to a Canarytokens collector when required

phone-homeReviewed by BitbisonUpdated 2026-11-02

Both live versions read the machine's hostname at require time and send it in an HTTP request to a canarytokens.com URL, undisclosed: a dependency-confusion probe.

What the analysis saw

The registry's build of resource_registry@109.0.22 (run 9618e3c0-9f8e-4ea2-baee-8e273a5c5365) flagged an unexpected network connection in the install-require job. The Ruby process that ran gem "resource_registry", "109.0.22"; require "resource_registry" opened a plain-HTTP connection to zpv9mqi86ioo2avmp2d92t5lj.canarytokens.com:80, a request-capture (DNS and HTTP logging) service. The package declares no network behaviour, has no install hook or native extension, and its only other peer was the package manager fetching from index.rubygems.org.

What the code does

lib/resource_registry.rb:7-11, the gem's only file, runs at require time. It reads the machine's hostname with Socket.gethostname and sends it in the path of an HTTP GET to the Canarytokens URL above. A rescue with no body discards any failure, so nothing is shown to the user. 1.0.22 ships the same file byte for byte. Neither version documents the behaviour anywhere: both summaries read "PoC By H1d3_khan" (1.0.22: "Dependency confusion PoC By H1d3_khan"), the metadata names no source repository, and the homepage field is https://factorial.co, a company site the gem has no other tie to. The version number 109.0.22 is inflated so that a resolver offered both a private gem of this name and the public one takes the public one.

Conclusion

phone-home: both live versions of resource_registry (1.0.22, 109.0.22) sends the loading machine's hostname to a Canarytokens collector at require time, undisclosed, as a dependency-confusion probe.