bomber

bomber is an application that scans SBOMs for security vulnerabilities. Overview So you've asked a vendor for an Software Bill of Materials SBOM for one of their closed source products, and they provided one to you in a JSON file... now what? The first thing you're going to want to do is see if a...

MAL-2026-18518 Malicious code in dopc-client (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ecbe68fef68472dcc1e9778859b71dcba31c06e8db799d75bb95c013f6ab1da On require 'dopc-client', lib/dopc-client.rb issues a plaintext HTTP GET to the hardcoded bare IP 38.242.235.206 at path /depconf/dopc-client/require...

Malicious code in dopc-client (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ecbe68fef68472dcc1e9778859b71dcba31c06e8db799d75bb95c013f6ab1da On require 'dopc-client', lib/dopc-client.rb issues a plaintext HTTP GET to the hardcoded bare IP 38.242.235.206 at path /depconf/dopc-client/require...

Malicious code in shoaib-unity (RubyGems)

Source: ossf-package-analysis ba322db91ecd6b863e8b06aa24b804a27f29cf2c8e2954bc1e77d7dc45e2fd52 The OpenSSF Package Analysis project identified 'shoaib-unity' @ 1.0.1 rubygems as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...

Malicious code in intercom-react-native-example-e2e-tests (RubyGems)

Source: ossf-package-analysis f17f130fc5b4fa9192f15a6e914928336f4e591d424b5bec8696923519d2793f The OpenSSF Package Analysis project identified 'intercom-react-native-example-e2e-tests' @ 1.0.1 rubygems as malicious. It is considered malicious because: - The package communicates with a domain...

Malicious code in intercom-react-native-example-e2e-tests (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57e084aff68cdd6201d55d3375bbc29f6e741553d4ac083f910fc38e110ef3d1 The gem declares ext/mkrfconf.rb as an extension script, so it runs automatically on gem install. The script collects host reconnaissance data...

MAL-2026-18461 Malicious code in shoaib-unity (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01fd98b807f4f85a6e016b143dec086ea16de731fb1de0cd84763dbf5d8f6919 The gem declares an extension script mkrfconf.rb that runs automatically during gem install. On execution, it collects installer host identifiers...

Malicious code in shoaib-unity (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01fd98b807f4f85a6e016b143dec086ea16de731fb1de0cd84763dbf5d8f6919 The gem declares an extension script mkrfconf.rb that runs automatically during gem install. On execution, it collects installer host identifiers...

Malicious code in macs-shoaibs-pro17 (RubyGems)

Source: ossf-package-analysis b839ba696947a26e059bc82d4feb35120e11ff4885ff5bc5da19d9800f51f837 The OpenSSF Package Analysis project identified 'macs-shoaibs-pro17' @ 90002.1 rubygems as malicious. It is considered malicious because: - The package communicates with a domain associated with malicio...

MAL-2026-18436 Malicious code in macs-shoaibs-pro17 (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c7ce0186e7517c1df32cfd61177f90bee77d43a19d7c3963cc657e07109123a The gem declares ext/mkrfconf.rb as a native extension, which RubyGems auto-executes during gem install. The script contains no mkmf/rake build logic...

Malicious code in macs-shoaibs-pro17 (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c7ce0186e7517c1df32cfd61177f90bee77d43a19d7c3963cc657e07109123a The gem declares ext/mkrfconf.rb as a native extension, which RubyGems auto-executes during gem install. The script contains no mkmf/rake build logic...

abhinavagarwal07.github.io

Chirpy Starter When installing the Chirpy theme through RubyGems.org, Jekyll can only read files in the folders data, layouts, includes, sass and assets, as well as a small part of options of the config.yml file from the theme's gem. If you have ever installed this theme gem, you can use the...

CLEANSTART-2026-HI05210 RubyGems version 2

CVE-2017-0902 affects multiple packages. RubyGems version 2. See references for individual vulnerability details...

CLEANSTART-2026-JZ03592 RubyGems version 2

CVE-2017-0901 affects multiple packages. RubyGems version 2. See references for individual vulnerability details...

CLEANSTART-2026-DU67929 RubyGems version 2

CVE-2017-0899 affects multiple packages. RubyGems version 2. See references for individual vulnerability details...

Malicious code in zzhelloworld_socktest (RubyGems)

Source: amazon-inspector 4344ab16d08a7e38ea2f32b406453f86d792c0fa17103125ad84ffd0e39c187f On require "zzhelloworldsocktest", the library's top-level module body opens a TCP connection to the hardcoded remote endpoint 66.78.40.218:32768, reopens STDIN, STDOUT, and STDERR onto that socket, and exec...

Malicious code in zzhelloworld_socktest (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4344ab16d08a7e38ea2f32b406453f86d792c0fa17103125ad84ffd0e39c187f On require "zzhelloworldsocktest", the library's top-level module body opens a TCP connection to the hardcoded remote endpoint 66.78.40.218:32768,...

MAL-2026-18126 Malicious code in zzhelloworld_socktest (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4344ab16d08a7e38ea2f32b406453f86d792c0fa17103125ad84ffd0e39c187f On require "zzhelloworldsocktest", the library's top-level module body opens a TCP connection to the hardcoded remote endpoint 66.78.40.218:32768,...

Malicious code in data-pipeline-testmetest (npm)

data-pipeline-testmetest 2.0.1 is a self-spreading credential stealer that runs on npm install without an install script: its binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, an obfuscated loader that decrypts a 939 KB payload and pipes it into Bun downloaded from GitHub...

Malicious code in wallet-hd-derive (RubyGems)

Source: amazon-inspector fdfb31a6866dee961d55ad503da9de33a2cf743b52c80862e4380519ad5bef12 The gem is published as a crypto wallet utility but ships no native source; its gemspec declares extconf.rb as an extension so that gem install auto-executes it. extconf.rb decodes a base64-encoded Ruby...