Malicious RubyGems install-time exfiltration: buffer-code-exercise-api & cheesebox — gems steal system files via fake native extension
Severity: critical · Patch status: no-fix-needed · Since 2026-11-12
Two malicious RubyGems packages, buffer-code-exercise-api 1.0.1 and cheesebox 10.0.1, were identified on 2026-11-12 via GitHub advisories (GHSA-9v6c-5wvv-8xq9, GHSA-9487-f86j-23m4) credited to OpenSSF/amazon-inspector. Both gems abuse the gemspec extensions: entry to run mkrfconf.rb automatically during gem install. The scripts perform no native build work; instead they collect hostname, username, cwd, home directory and the contents of /etc/passwd, /etc/hosts and /etc/resolv.conf, JSON-encode them, and POST them over TLS to hardcoded Burp Collaborator OAST subdomains (0ef6jllhq32e17z4aaeqzbgn3e9fx5lu.oastify.com and xwx31i3e80kbj4h1s7wnh8yklbrdf33s.oastify.com), preceded by a DNS probe. Any developer or CI system installing these versions leaks host data to attacker infrastructure. No patched versions exist; the gems should be removed and not installed.
What to do
- Check Gemfile.lock and installed gems for buffer-code-exercise-api 1.0.1 or cheesebox 10.0.1 and remove them immediately
- If installed, treat the build host as compromised: rotate credentials available to the install user and review /etc/passwd, /etc/hosts, /etc/resolv.conf exposure impact
- Block the oastify.com subdomains at DNS and egress proxies and hunt for prior TLS/DNS connections to them
- Audit gemspecs of dependencies for extensions: entries with mkrf_conf.rb that ship no native sources
- Prefer pinned, checksum-verified gems and restrict gem install execution in CI
Sources
All live incidents on Threat Watch
