Skip to content
Open-Source Registry

gem / shoaib-unity / 1.0.1

shoaib-unity 1.0.1

bitbison: no public build not built
processes
147
operations
2.7K
packages
0
compiler runs
0
connections
1
build time
1s
job time
1s
capture
50 KB
records
4.7K
bytes / record
10.7
run 8aa51b78-b9fe-4678-8616-15c06463ed0c · built 2026-11-02 · complete
Reviewed by Bitbison: maliciousThe gem's install-time extension collects /etc/passwd, /etc/hosts, /etc/resolv.conf, the hostname, user and paths, and POSTs them to d8mjdyfukgwrvkth4n83toa0xr3lrgf5.oastify.com.

This release did not build; nothing below stands for the package.

Graph

egress · high
2

Checks

8 of 10 clear · 1 not checked Network activity
Build behavior▲✓✓✓✓✓✓✓
Supply chain○
Pipeline✓

Detections

1
  • Build script connected to a request-capture service: d8mjdyfukgwrvkth4n83toa0xr3lrgf5.oastify.com:443
    shoaib-unity 1.0.1 › d8mjdyfukgwrvkth4n83toa0xr3lrgf5.oastify.com:443
    high

Detection

highwitnessed

Build script connected to a request-capture service: d8mjdyfukgwrvkth4n83toa0xr3lrgf5.oastify.com:443

Unexpected network connection

Subject
shoaib-unity 1.0.1
Destination
d8mjdyfukgwrvkth4n83toa0xr3lrgf5.oastify.com:443
Jobs
install-require
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to d8mjdyfukgwrvkth4n83toa0xr3lrgf5.oastify.com:443, opened by ruby3.3

    subject d8mjdyfukgwrvkth4n83toa0xr3lrgf5.oastify.com:443

    by /usr/bin/ruby3.3 mkrf_conf.rb

  2. What a build script's fetch becamesupport

    1 file came down, reaching 3 more; nothing the build compiled, linked or ran

  3. Connection opened by a build script or child processsupport

    the opener is the build script at /usr/bin/ruby3.3 mkrf_conf.rb

  4. What kind of service the host issupport

    d8mjdyfukgwrvkth4n83toa0xr3lrgf5.oastify.com:443: Burp Collaborator

What came before it

Loading the graph

Processes

install-require

env›ruby›ruby3.3

Ran
/usr/bin/ruby3.3 mkrf_conf.rb
Invoked by
/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/shoaib-unity-1.0.1.gem
Lineage · 3 processes
  1. env/usr/bin/env ruby /usr/bin/gem install --no-document --verbose pkg/shoaib-unity-1.0.1.gem2531
  2. rubyruby /usr/bin/gem install --no-document --verbose pkg/shoaib-unity-1.0.1.gem2533
  3. ruby3.3/usr/bin/ruby3.3 mkrf_conf.rb2544

Remediation

A dependency's build connected to a service build code has no use for: one that records what is sent to it, forwards it elsewhere, or delivers it to people. Review what the build could read and send, rotate any credential it could reach, and pin or replace the dependency.

Network

1 peers
  • d8mjdyfukgwrvkth4n83toa0xr3lrgf5.oastify.com:443 shoaib-unity's own build code · ruby3.3 · Amazon.com, Inc. · 1 file undeclared
Versions1RiskVulnsPublished
1.0.1did not build10h ago

Raw data

capture
50 KB
records
4,691
bytes per record
10.7

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: install-require failure · Generated 2026-11-02 · run 8aa51b78-b9fe-4678-8616-15c06463ed0c

analysis 0.1.0 · 2026-11-02 · a8bbe26 · graph v2

Sends /etc/passwd, host and resolver config to a request-capture host at install

maliciousCovers 1.0.1Reviewed by BitbisonUpdated 2026-11-02

The gem's install-time extension collects /etc/passwd, /etc/hosts, /etc/resolv.conf, the hostname, user and paths, and POSTs them to d8mjdyfukgwrvkth4n83toa0xr3lrgf5.oastify.com.

What the analysis saw

The registry's build of shoaib-unity@1.0.1 (build d1ee753a-a1d1-4e78-a1b1-b4317fabb2e3) flagged its install: while gem install ran the gem's extension script, /usr/bin/ruby3.3 mkrf_conf.rb resolved and connected to d8mjdyfukgwrvkth4n83toa0xr3lrgf5.oastify.com:443, a request-capture service, and sent data to it. Nothing the build compiled, linked or ran came from that host.

What the code does

ext/mkrf_conf.rb, declared as the gem's extension so that RubyGems runs it at install, before anything requires the gem:

  • looks up d8mjdyfukgwrvkth4n83toa0xr3lrgf5.oastify.com (a DNS callback);
  • collects the working directory, the home directory, the hostname, the login name, and the full contents of /etc/passwd, /etc/hosts and /etc/resolv.conf;
  • POSTs them as JSON over TLS to https://d8mjdyfukgwrvkth4n83toa0xr3lrgf5.oastify.com/, tagged my_shoaib;
  • discards every error, then writes lib/.installed.

The library itself is an empty module stub. The gem's summary is "A simple gem"; its metadata names no source. The owner (testneo378) published two gems with the same script on the same day, each with its own collector host.

OpenSSF Package Analysis reported this release as malicious (MAL-2026-18461).

Conclusion

malicious: installing the gem sends the machine's account list, host and resolver configuration, and identity to an attacker's request-capture host, undisclosed.

Indicators

hosts
d8mjdyfukgwrvkth4n83toa0xr3lrgf5.oastify.com

Examined

1.0.1
sha256:6f1255c1fe4a48f82acf95b88aff9c420be1089df8b976b1f2f18312480a31b6

Links