w002yardprobe

GHSA-cv4q-gcjm-77v8

Malicious code in w002yardprobe (RubyGems)

Details

**Severity:** Critical

**Affected versions:** `= 0.0.4`

## Source: amazon-inspector (721580f8eda44ad5ee7604f5ba0648e8830302f784e3e4a995e02ca7359c909e)
The gem ships a `.yardopts` file containing `--load./script.rb`, which causes YARD to execute `script.rb` whenever documentation is generated for the gem (locally via `yard doc`, in CI, or on doc-hosting services such as RubyDoc.info). `script.rb` collects host identifiers — `Socket.gethostname`, current working directory, UID, and `RUBY_VERSION` — and POSTs them via `Net::HTTP.post_form` to the hardcoded third-party collector `https://webhook.site/97fa3c6a-3fad-4d2d-8312-15dc37e41e66`. The same script also rewrites `lib/w002yardprobe.rb` in place (substituting a `MARKSLOT` token with a runtime stamp) and drops sentinel files `W002SCRIPT_RAN.txt` and `W002EGRESS_OK.txt` in the detected build directory (e.g. `/build`), indicating the gem is instrumented to probe a documentation-build sandbox. The package self-identifies as a probe; the exfiltration and build-environment mutation are the gem's purpose. The trigger is YARD doc generation rather than `gem install` or `require`, so the harm materializes against whichever host (developer workstation, CI runner, or doc-hosting pipeline) processes the gem's documentation.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/e4569c934b0c794114610da27397d7443c1bbf84/osv/malicious/rubygems/w002yardprobe/MAL-2026-18599.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/e4569c934b0c794114610da27397d7443c1bbf84/osv/malicious/rubygems/w002yardprobe/MAL-2026-18599.json
- https://rubygems.org/gems/w002yardprobe/versions/0.0.4
- https://rubygems.org/gems/w002yardprobe/versions/0.0.5
- https://github.com/advisories/GHSA-cv4q-gcjm-77v8

Compromised versions (1)

= 0.0.4

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.