Which versions of dynamic-object-handler are malicious?

The following RubyGems versions of dynamic-object-handler are flagged malicious: 1.0.1. Treat any of these as compromised.

How do I remediate dynamic-object-handler if I installed it?

Remove dynamic-object-handler from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed dynamic-object-handler — how do I know if it already compromised me?

If dynamic-object-handler was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is dynamic-object-handler part of a known attack campaign?

Yes — dynamic-object-handler is associated with the IN-MAL-2026-022568 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find dynamic-object-handler across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for dynamic-object-handler (version 1.0.1).

Malicious package

dynamic-object-handlerRubyGems

Advisory published Nov 8, 2026Updated Nov 8, 2026

dynamic-object-handler is a confirmed malicious RubyGems package (MAL-2026-18766) that executes malicious code on install (malicious version 1.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in dynamic-object-handler (RubyGems)

MAL-2026-18766

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall dynamic-object-handler

What this malware does

The gem declares mkrf_conf.rb as a native extension in metadata.yaml, causing it to execute automatically during gem install. The script collects the installer's current working directory, home directory path, hostname, login name, and the contents of /etc/resolv.conf, /etc/passwd, and /etc/hosts, then opens a TCP+TLS connection to the hardcoded Burp Collaborator subdomain unl0sfubzxb8a18yj4nk85phc8i66wul.oastify.com on port 443 and POSTs the collected data. A DNS resolution of the same oastify.com subdomain is issued first, producing an out-of-band DNS callback that confirms code execution on the installer's host even when outbound TCP/443 is blocked. The oastify.com domain is PortSwigger's OAST (Burp Collaborator) service, used to receive attacker-controlled callbacks; it has no first-party relationship to the gem's advertised purpose.

Malicious versions

1 flagged

1.0.1

Indicators of compromise (SHA-256)

bb6afd419500201966e8ccb55d2f3c8ea28caae5ec8bfc59a87dcf19ca9d022b

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for dynamic-object-handler (version 1.0.1).
If you installed it — respond
Remove dynamic-object-handler from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If dynamic-object-handler was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. dynamic-object-handler on RubyGems has been identified as a malicious package (version 1.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-022568

References

rubygems.org

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks dynamic-object-handler-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database