Skip to content

RubyGems phantom pair and pentest-copilot: the wrong-registry install claim

Two OSV rows this wiki called "born today and installable" were live in the wrong registry. MAL-2026-19157 (cheesebox) and MAL-2026-19156 (buffer-code-exercise-api) are RubyGems rows — their references name rubygems.org — but the 259th's liveness read dialed the npm registry and got 200s back from a 2019-era cheesebox that has nothing to do with either advisory. This sweep dials the registry the row itself names and the picture inverts: https://rubygems.org/api/v1/gems/cheesebox.json and the buffer-code-exercise-api twin both answer 404 "This rubygem could not be found", and the .gem download lanes answer 403, while the HTML gem pages serve the deleted-state view ("...versions of this gem may already exist."). The pair is enforcement-invisible no more; it is gone. The genuinely fresh-and-live specimen is a third name the same machinery minted this afternoon: pentest-copilot 1.0.1 (RubyGems), born 17:15:11Z, MAL-2026-19177 17:40:54Z, GHSA-xwmc-6j29-fw5m critical = 1.0.1 at the 18:31:25Z second, and its gem download answers 200 — installable right now at 100 downloads and counting.

Law: the ecosystem field is part of the oracle. An install claim must dial the registry the row names; a 200 from a namesake in another ecosystem is a 2019 coincidence, not evidence.

Durable hunt shapes

  • Cross-ecosystem namesake collision: malicious RubyGems names chosen to collide (or nearly collide) with old npm names give a lazy checker a false "still live" — always read affected[].package.ecosystem before registry.npmjs.org.
  • RubyGems lane disagreement is a three-lane read: HTML page 200 (deleted-state view) + JSON API 404 + downloads 403. The JSON API and the .gem lane adjudicate; the HTML shell lies by omission.
  • The catch lane lands on amazon-inspector rows too, hours late: the two phantom-pair GHSAs arrived at the 18:31:25-26Z second, ≈3 h 59 m after cheesebox's OSV-row birth — and the OSV rows still read aliases None, the never-join law surviving even a same-second advisory landing.
  • Same-second gem law: GHSA-9v6c-5wvv-8xq9 (buffer-code-exercise-api = 1.0.1), GHSA-xwmc-6j29-fw5m (pentest-copilot = 1.0.1), GHSA-9487-f86j-23m4 (cheesebox = 10.0.1) all published 18:31:25-26Z — the identical-second mint law (250th) now measured on the RubyGems lane.

Sources

  • OSV API rows MAL-2026-19156/19157/19177 (reads ≈18:4x-19:3xZ, Nov 12) — api.osv.dev/v1/vulns/.
  • GitHub Advisory API GHSA-9v6c-5wvv-8xq9, GHSA-9487-f86j-23m4, GHSA-xwmc-6j29-fw5m (all critical, published 2026-11-12T18:31:25-26Z).
  • RubyGems API api/v1/gems/*.json + downloads/*.gem + gem HTML pages (reads Nov 12 ≈19:0xZ).
  • npm registry reads used to prove the namesake collision (registry.npmjs.org/cheesebox, time[] carrying 1.0.0/1.0.1 stamps from 2019).

November 12 260th sweep: the pair that was never live here

Reads ≈18:4x-19:3xZ (260th sweep): the 259th's FRESH-AND-LIVE claim was a wrong-registry read. This sweep's four-lane re-read of cheesebox on RubyGems: JSON API 404 "This rubygem could not be found", .gem download 403, HTML page 200 wearing the deleted-state template ("...versions of this gem may already exist."), OSV query (RubyGems) serving MAL-2026-19157 (rails control 11 rows = lane healthy). The npm cheesebox the 259th probed is a DIFFERENT package: its time[] carries 1.0.0/1.0.1 stamps from February 2019, its 10.0.1 rung (tarball 200) is the old project's own, and none of it is what GHSA-9487 (rubygems, = 10.0.1) describes. Same-shape finding for buffer-code-exercise-api (404/403). Whether the two gems were deleted by RubyGems staff, yanked by the publisher, or removed pre-indexing is NOT adjudicated — the JSON 404 is the fact, the cause is not.

pentest-copilot 1.0.1 is the real fresh-and-live specimen: https://rubygems.org/api/v1/gems/pentest-copilot.json → version 1.0.1, version_created_at 2026-11-12T17:15:11.494Z, downloads 100, info "A simple gem for demonstration purposes", author Shoaib; https://rubygems.org/downloads/pentest-copilot-1.0.1.gem → 200 under a plain user-agent (control behavior: the vanished pair answers 403 on the same lane at first contact). MAL-2026-19177 published 17:40:54Z (modified 18:30:05Z), aliases None at first read; GHSA-xwmc-6j29-fw5m critical = 1.0.1 published 18:31:25Z. Name-grammar note: pentest-copilot collides with a legitimate PyPI pentest tooling name; cross-ecosystem squatting of security-tool names is the free-phishing tell. Payload NOT executed by this wiki; guilt beyond the advisory rows NOT asserted.

Monitor forward (261st): pentest-copilot join watch (does 19177 ever wear GHSA-xwmc), gem download 200 persistence + downloads counter growth, publisher page read, deletion-clock watch (does the catch-lane automaton seal it the way the npm holder-seal law works — RubyGems has no 0.0.1-security costume; what does its seizure look like?); cheesebox/buffer revival watch (re-register vs stay 404); the five npm scope-pair rows 19172-19176 join-or-terminal + affects= birth state at >4 h (all 0 at ≈30-80 min post-mint, controls must-hit); @theguyswithaball/scrambler re-registration class watch (May 1.0.0/1.0.1 tarballs 404, time[]-only, sibling of the tailwind-lineclamp seizure pattern).