Skip to content
Heist/ feed
Back to feed
Unrated

Malicious code in zzhelloworld_socktest (RubyGems)

Type: advisorySources: OSV

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4344ab16d08a7e38ea2f32b406453f86d792c0fa17103125ad84ffd0e39c187f) On `require "zzhelloworld_socktest"`, the library's top-level module body opens a TCP connection to the hardcoded remote endpoint 66.78.40.218:32768, reopens STDIN, STDOUT, and STDERR onto that socket, and execs `/bin/sh -i`. Loading the gem gives the operator of that remote host an interactive shell on the installing machine, with no authentication and full process privileges. The gem's stated purpose is a trivial test library, which does not match a remote-shell capability. The destination is a bare IPv4 address unrelated to any declared publisher infrastructure.

Products
zzhelloworld_socktest
Affected versions
0.1.5, 0.1.6, 0.1.7, 0.1.8, 0.1.9, 0.2.0, 0.2.1
Fixed versions
Not specified
CVEs
Not specified
Confirmed fixed CVEs
Not specified
Updated in this feed
31 Oct 2026, 16:37 UTC · Revision 1

Source evidence

Malicious code in zzhelloworld_socktest (RubyGems)

core-osv · Original source

Published 21 Oct 2026, 21:47 UTC

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4344ab16d08a7e38ea2f32b406453f86d792c0fa17103125ad84ffd0e39c187f) On `require "zzhelloworld_socktest"`, the library's top-level module body opens a TCP connection to the hardcoded remote endpoint 66.78.40.218:32768, reopens STDIN, STDOUT, and STDERR onto that socket, and execs `/bin/sh -i`. Loading the gem gives the operator of that remote host an interactive shell on the installing machine, with no authentication and full process privileges. The gem's stated purpose is a trivial test library, which does not match a remote-shell capability. The destination is a bare IPv4 address unrelated to any declared publisher infrastructure.

osv:MAL-2026-18126

zzhelloworld_socktest

Fixed versions: Not specified

Complete source record
{
  "id": "e5ee3828157fc96af9597cb665baa59b2bdfd2595724dccd6ab2fb536d3adc92",
  "url": "https://osv.dev/vulnerability/MAL-2026-18126",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Malicious code in zzhelloworld_socktest (RubyGems)",
    "summary": "--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4344ab16d08a7e38ea2f32b406453f86d792c0fa17103125ad84ffd0e39c187f) On `require \"zzhelloworld_socktest\"`, the library's top-level module body opens a TCP connection to the hardcoded remote endpoint 66.78.40.218:32768, reopens STDIN, STDOUT, and STDERR onto that socket, and execs `/bin/sh -i`. Loading the gem gives the operator of that remote host an interactive shell on the installing machine, with no authentication and full process privileges. The gem's stated purpose is a trivial test library, which does not match a remote-shell capability. The destination is a bare IPv4 address unrelated to any declared publisher infrastructure.",
    "evidence": "osv:MAL-2026-18126",
    "products": [
      {
        "name": {
          "value": "zzhelloworld_socktest",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "0.1.9",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.1.5",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.1.6",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.2.0",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.1.7",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.2.1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "0.1.8",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "MAL-2026-18126",
      "aliases": [
        "MAL-2026-18126"
      ],
      "affected": [
        {
          "package": {
            "name": "zzhelloworld_socktest",
            "purl": "pkg:gem/zzhelloworld_socktest",
            "ecosystem": "RubyGems"
          },
          "versions": [
            "0.1.9",
            "0.1.5",
            "0.1.6",
            "0.2.0",
            "0.1.7",
            "0.2.1",
            "0.1.8"
          ],
          "database_specific": {
            "cwes": [
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              },
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              }
            ],
            "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/zzhelloworld_socktest/MAL-2026-18126.json",
            "indicators": {
              "evidence_files": [
                {
                  "path": "lib/zzhelloworld_socktest.rb",
                  "tlsh": "92e0268da2319426b43a42cfe0e5b426a9a2d06b460aa46bb7f02b84ef071754ec0971",
                  "sha256": "b9126fcf18d64dfe1509a6c5b1203d256275362efb74d9e9799151e89f008630"
                }
              ],
              "package_integrity": [
                {
                  "hashes": {
                    "sha256": "71d36652d66acaaa93586f70c97a52f59aaba0ecfbf2628080d266806a3f0db4"
                  },
                  "filename": "zzhelloworld_socktest-0.1.9.gem"
                }
              ]
            }
          }
        }
      ],
      "modified": "2026-10-21T22:30:06.539192766Z",
      "provider": "osv",
      "references": [
        "https://rubygems.org/gems/zzhelloworld_socktest/versions/0.1.9",
        "https://rubygems.org/gems/zzhelloworld_socktest/versions/0.1.5",
        "https://rubygems.org/gems/zzhelloworld_socktest/versions/0.1.6",
        "https://rubygems.org/gems/zzhelloworld_socktest/versions/0.2.0",
        "https://rubygems.org/gems/zzhelloworld_socktest/versions/0.1.7",
        "https://rubygems.org/gems/zzhelloworld_socktest/versions/0.2.1",
        "https://rubygems.org/gems/zzhelloworld_socktest/versions/0.1.8"
      ],
      "provider_metadata": {
        "malicious-packages-origins": [
          {
            "id": "IN-MAL-2026-021555",
            "sha256": "00eefa91b94c7e3748de1b6d1c964c91592606507816ff51e54071e0b73dbd51",
            "source": "amazon-inspector",
            "versions": [
              "0.1.9"
            ],
            "import_time": "2026-10-21T22:16:18.292937557Z",
            "modified_time": "2026-10-21T22:01:57Z"
          },
          {
            "id": "IN-MAL-2026-021551",
            "sha256": "2e11e9da0f4a2f8b06b1c4c1387a526ef38e43584c1fb4db814dff1333377140",
            "source": "amazon-inspector",
            "versions": [
              "0.1.5"
            ],
            "import_time": "2026-10-21T22:16:17.899683904Z",
            "modified_time": "2026-10-21T21:47:07Z"
          },
          {
            "id": "IN-MAL-2026-021553",
            "sha256": "4344ab16d08a7e38ea2f32b406453f86d792c0fa17103125ad84ffd0e39c187f",
            "source": "amazon-inspector",
            "versions": [
              "0.1.6"
            ],
            "import_time": "2026-10-21T22:16:18.094595695Z",
            "modified_time": "2026-10-21T21:47:20Z"
          },
          {
            "id": "IN-MAL-2026-021556",
            "sha256": "54f3d8d6b0e7bf929891e4906dfa8205b7205df6ac6f0b6dcf8502342fc49c18",
            "source": "amazon-inspector",
            "versions": [
              "0.2.0"
            ],
            "import_time": "2026-10-21T22:16:18.403267434Z",
            "modified_time": "2026-10-21T22:02:06Z"
          },
          {
            "id": "IN-MAL-2026-021552",
            "sha256": "6c20f8c727164e8ee07f7dfed2e15c9aa88d3119eac98045c3e7284303327ab8",
            "source": "amazon-inspector",
            "versions": [
              "0.1.7"
            ],
            "import_time": "2026-10-21T22:16:17.99813523Z",
            "modified_time": "2026-10-21T21:47:13Z"
          },
          {
            "id": "IN-MAL-2026-021557",
            "sha256": "b9d9d0a1e5212b4b412a292f78b24635113698cb1c590a4f39a4de5d4ebefb4d",
            "source": "amazon-inspector",
            "versions": [
              "0.2.1"
            ],
            "import_time": "2026-10-21T22:16:18.544695221Z",
            "modified_time": "2026-10-21T22:02:16Z"
          },
          {
            "id": "IN-MAL-2026-021554",
            "sha256": "e1e8e31f4fb323332234cbb199545db2d1f3b515341e16b4d713970353baad5c",
            "source": "amazon-inspector",
            "versions": [
              "0.1.8"
            ],
            "import_time": "2026-10-21T22:16:18.198572691Z",
            "modified_time": "2026-10-21T21:47:28Z"
          }
        ]
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 401010,
  "published_at": "2026-10-21T21:47:07+00:00"
}