Suspicious ^91% ruby 112,431 installs Download

hiiro 0.1.383

legitimate CLI framework

“Build multi-command CLI tools with subcommand dispatch, abbreviation matching, and a plugin system. Similar to git or docker command struct…”

system() + Base64.decode64 (Ruby command execution)Ruby launchctl bootout

SHA-2565de266181a0bc95701453f1f4430a07132427068d1d7e3c551433c35d9417d90

URLhttps://rubygems.org/gems/hiiro-0.1.383.gem

MaleculeK₃(AmMcTe)O₈(As₅ICCa₃La₂P₂S₄Xe₃)H₉(Cm₁₅CrDb₂₂F₂₂HfOs₇Po₁₅TiU₁₅)Md₃(Pa₃Pd)

Evidence

Ruby imports the Base64 library h-img · lines 1–48

1#!/usr/bin/env ruby
2
3require 'hiiro'
4require 'base64'
5require 'tempfile'
6
7MIME_TYPES = {
8  'jpg'  => 'image/jpeg',
9  'jpeg' => 'image/jpeg',
10  'gif'  => 'image/gif',
11  'webp' => 'image/webp',
12  'png'  => 'image/png',
13}.freeze
14
15def mime_for(path)
16  MIME_TYPES.fetch(File.extname(path).downcase.delete('.'), 'image/png')
17end
18
19def clipboard_image_to_tempfile
20  tmp = Tempfile.new(['h-img-', '.png'])
21  tmp.close
22  unless system('pngpaste', tmp.path, out: File::NULL, err: File::NULL)
23    tmp.unlink
24    return nil
⋯6 lines
31    unless outpath
32      puts "Usage: h img save <outpath>"
33      exit 1
34    end
35
⋯4 lines
40    end
41
42    FileUtils.mv(tmp.path, outpath)
43    puts "Saved to #{outpath}"
44  }
⋯4 lines

Reads binary content with Ruby File.binread h-img · lines 49–57

14… "File not found: #{path}"
      exit 1
    end
    data = File.binread(path)
    mime = mime_for(path)
  else
    tmp = clipboard_image_to_tempfile
    unless tmp
      puts "No image in cl …

Encodes Base64 data in Ruby h-img · lines 61–67

20… /png'
    tmp.unlink
  end
64
  puts "data:#{mime};base64,#{Base64.strict_encode64(data)}"
}
67}

Perl or Ruby system process call h-docs · lines 107–115

107:21… | item_label(item) == choice.strip }
108end
109
110def open_item(item)
111  system('open', API.absolute_url(item['href']))
112end
113
114def service_loaded?
115  system('launchctl', 'print', SERVICE_TARGET, out: File::NULL …

Ruby launchctl bootout h-docs · lines 124–140

124:2… nd
125
126def stop_service
127  return puts('Portfolio is not loaded.') unless service_loaded?
128
129  system('launchctl', 'bootout', SERVICE_TARGET)
130end
131
⋯9 lines

Showing the top 5 files — 6 more files (73 regions) not shown.

No evidence locations were recorded for this file. Raw result