dynamic-object-handler (RubyGems) · Malicious Code
Affects dynamic-object-handlerSource GCVE Database
Malicious package : remove dynamic-object-handler and rotate any secrets on hosts that installed it.
Data as of 8 Nov 2026, 10:51 UTC
Malicious package
Published to RubyGems · OSV MAL-2026-18766
What to do
Remove dynamic-object-handler from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| RubyGemsdynamic-object-handler | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The RubyGem 'dynamic-object-handler' version 1.0.1 contains malicious code in its native extension mkrf_conf.rb. During installation, it collects sensitive system information including directory paths, hostname, login name, and contents of critical system files. This data is exfiltrated via a TLS-encrypted POST request to a hardcoded Burp Collaborator subdomain, enabling out-of-band confirmation of code execution even if outbound TCP/443 is blocked.