shoaib-unity

maliciousCovers 1.0.1Reviewed by BitbisonUpdated 2026-11-02

The gem's install-time extension collects /etc/passwd, /etc/hosts, /etc/resolv.conf, the hostname, user and paths, and POSTs them to d8mjdyfukgwrvkth4n83toa0xr3lrgf5.oastify.com.

What the analysis saw

The registry's build of shoaib-unity@1.0.1 (build d1ee753a-a1d1-4e78-a1b1-b4317fabb2e3) flagged its install: while gem install ran the gem's extension script, /usr/bin/ruby3.3 mkrf_conf.rb resolved and connected to d8mjdyfukgwrvkth4n83toa0xr3lrgf5.oastify.com:443, a request-capture service, and sent data to it. Nothing the build compiled, linked or ran came from that host.

What the code does

ext/mkrf_conf.rb, declared as the gem's extension so that RubyGems runs it at install, before anything requires the gem:

• looks up d8mjdyfukgwrvkth4n83toa0xr3lrgf5.oastify.com (a DNS callback);
• collects the working directory, the home directory, the hostname, the login name, and the full contents of /etc/passwd, /etc/hosts and /etc/resolv.conf;
• POSTs them as JSON over TLS to https://d8mjdyfukgwrvkth4n83toa0xr3lrgf5.oastify.com/, tagged my_shoaib;
• discards every error, then writes lib/.installed.

The library itself is an empty module stub. The gem's summary is "A simple gem"; its metadata names no source. The owner (testneo378) published two gems with the same script on the same day, each with its own collector host.

OpenSSF Package Analysis reported this release as malicious (MAL-2026-18461).

Conclusion

malicious: installing the gem sends the machine's account list, host and resolver configuration, and identity to an attacker's request-capture host, undisclosed.

Links

• RubyGems page
• OpenSSF malicious-packages MAL-2026-18461