YARD-doc exfil probe: w002yardprobe RubyGems — malicious gem exfiltrates host info during doc generation (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-04
The RubyGems package w002yardprobe (versions 0.0.4 and 0.0.5) is confirmed malware, flagged by Amazon Inspector and published to the GitHub Advisory Database (GHSA-cv4q-gcjm-77v8) via OpenSSF. The gem ships a .yardopts file with --load./script.rb, causing YARD to execute script.rb whenever documentation is generated — locally, in CI, or on doc-hosting services like RubyDoc.info. The script collects hostname, working directory, UID, and Ruby version, and POSTs them to a hardcoded webhook.site collector. It also rewrites lib/w002yardprobe.rb in place and drops sentinel files (W002SCRIPTRAN.txt, W002EGRESSOK.txt) in the build directory, indicating it is an instrumented probe of documentation-build sandboxes. There are no patched versions; the package must be removed, not upgraded.
What to do
- Remove w002yardprobe from all Gemfiles, lockfiles, and dependency caches; do not use any version
- Audit CI runners, developer workstations, and doc-build hosts that may have generated docs for the gem for sentinel files W002SCRIPT_RAN.txt / W002EGRESS_OK.txt and modifications to lib/w002yardprobe.rb
- Block egress to webhook.site/97fa3c6a-3fad-4d2d-8312-15dc37e41e66 and review any outbound requests to webhook.site from build systems
- Review YARD/doc-generation pipelines for --load directives in .yardopts from untrusted gems and sandbox doc builds
- Rotate credentials/secrets present on affected build hosts if compromise indicators are found
Sources
All live incidents on Threat Watch
