Benign gem 991,453 installs Download

ghost 0.2.4

Legitimate hostname management gem

“Allows you to create, list, and modify local hostnames on POSIX systems (e.g. Mac OS X and Linux) and Windows”

Ruby subshell command executionRuby dynamically invokes a method with send
SHA-2569e1404a756b682fac3e49f3e5d6f0a7cf4a7f288a9160b4e1bf93f0fb1d06e7d

Evidence

Ruby subshell command execution linux-host.rb · lines 13–25
⋯4 lines
17 @@hosts_file = '/etc/hosts'
18 @@permanent_hosts = [Host.new("localhost", "127.0.0.1"),
19 Host.new(`hostname`.chomp, "127.0.0.1")]
20 class << self
21 protected :new
⋯4 lines
Executes a command with Ruby backticks mac-host.rb · lines 5–24
⋯4 lines
9
10 def list
11 list = `#{ListCmd}`
12 list = list.split("\n")
13 list.collect { |host| Host.new(host.chomp) }
14 end
15
16 def add(host, ip = "127.0.0.1", force = false)
17 if find_by_host(host).nil? || force
18 `#{CreateCmd % [host, ip]}`
19 flush!
20 find_by_host(host)
⋯4 lines
Ruby dynamically invokes a method with send mac-host.rb · lines 89–108
⋯10 lines
99
100 def ip
101 @ip ||= self.class.send(:parse_ip, dump)
102 end
103
104 private
105 def dump
106 @dump ||= `#{ReadCmd % hostname}`
107 end
108end
Terminates the Ruby process with exit ghost · lines 21–31
21:8… #{script_name} export
22 #{script_name} import <file>
23"""
24 exit(exit_code)
25end
26
⋯5 lines
English function-word token "the" ghost · lines 39–43
39:15… r.puts "Cannot overwrite an existing entry. Use the modify subcommand"
40 exit 3
41 end
42 else
43 $stderr.puts "The add subcommand req …

No evidence locations were recorded for this file. Raw result

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.