brida-frida-hooks

GHSA-vqw2-j6mj-82hq

Malicious code in brida-frida-hooks (RubyGems)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.1`

## Source: amazon-inspector (cc383ba7728e9aec64324ce8b1c9b354b0331d7c404888e39d1d127885381e1d)
The gem declares an extension script in its gemspec that executes during `gem install`. On install, the script collects installer identity and local system data — current working directory, home directory, hostname, username, and the contents of /etc/resolv.conf, /etc/passwd, and /etc/hosts — and POSTs them over TLS via a raw TCPSocket to the hardcoded Burp Collaborator subdomain bjyhowqsve7p6i4fflj14mly8pel2bq0.oastify.com on port 443. The exfiltration is unrelated to the gem's stated 'simple demo' purpose and runs automatically on default install.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/e4569c934b0c794114610da27397d7443c1bbf84/osv/malicious/rubygems/brida-frida-hooks/MAL-2026-18598.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/e4569c934b0c794114610da27397d7443c1bbf84/osv/malicious/rubygems/brida-frida-hooks/MAL-2026-18598.json
- https://rubygems.org/gems/brida-frida-hooks/versions/1.0.1
- https://github.com/advisories/GHSA-vqw2-j6mj-82hq

Compromised versions (1)

= 1.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.