zzhelloworld_socktestRubyGems
Advisory published Updated
zzhelloworld_socktest is a confirmed malicious RubyGems package (MAL-2026-18126) that executes malicious code on install (malicious versions 0.1.5, 0.1.6, 0.1.7…). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in zzhelloworld_socktest (RubyGems)
What this malware does
On require "zzhelloworld_socktest", the library's top-level module body opens a TCP connection to the hardcoded remote endpoint 66.78.40.218:32768, reopens STDIN, STDOUT, and STDERR onto that socket, and execs /bin/sh -i. Loading the gem gives the operator of that remote host an interactive shell on the installing machine, with no authentication and full process privileges. The gem's stated purpose is a trivial test library, which does not match a remote-shell capability. The destination is a bare IPv4 address unrelated to any declared publisher infrastructure.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Malicious packageFind it
Search your lockfiles and build artifacts for zzhelloworld_socktest (7 malicious versions).
If you installed it — respond
Remove zzhelloworld_socktest from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If zzhelloworld_socktest was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks zzhelloworld_socktest-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.