buffer-code-exercise-api (RubyGems) · Malicious Code
Affects buffer-code-exercise-apiSource GCVE Database
Malicious package : remove buffer-code-exercise-api and rotate any secrets on hosts that installed it.
Data as of 12 Nov 2026, 17:35 UTC
Malicious package
Published to RubyGems · OSV MAL-2026-19156
What to do
Remove buffer-code-exercise-api from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| RubyGemsbuffer-code-exercise-api | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The buffer-code-exercise-api RubyGem version 1.0.1 contains malicious code embedded in a file declared as a native extension. During gem installation, this code executes and collects sensitive system information including hostname, login name, current working directory, home directory, and contents of system files such as /etc/passwd, /etc/hosts, and /etc/resolv.conf. It then encodes this data in JSON and sends it over TLS to a hardcoded external server unrelated to the package publisher. This behavior is indicative of data exfiltration via an install-time execution vector.