pentest-copilot (RubyGems) · Malicious Code
Affects pentest-copilotSource GCVE Database
Malicious package : remove pentest-copilot and rotate any secrets on hosts that installed it.
Data as of 12 Nov 2026, 23:34 UTC
Malicious package
Published to RubyGems · OSV MAL-2026-19177
What to do
Remove pentest-copilot from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| RubyGemspentest-copilot | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (23e305059e2c1f7f8f37b8478aa90214d1e916fc3f2287eb90f7bca7e9dcac32) The gem declares an extension script (mkrf_conf.rb / RakeBuilder) that runs automatically on `gem install`. At install time it collects installer-side identifiers (current working directory, home directory, hostname, login name) and reads local files /etc/resolv.conf, /etc/passwd, and /etc/hosts, then performs a DNS lookup to the Burp Collaborator subdomain vfe1kgmcry39220zb5fl06hi49acy2mr.oastify.com and opens a TLS connection to the same host on port 443, POSTing the collected host identifiers and file contents in the request body. The Collaborator destination is attacker-controlled out-of-band infrastructure typical of install-time exfiltration beacons. ## Source: ossf-package-analysis (8ed8a5f6d36e52a081b16492d7bc0cd65dc392d085384781cf3d661d47fca019) The OpenSSF Package Analysis project identified 'pentest-copilot' @ 1.0.1 (rubygems) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.