Exploit Public-Facing Application

Gems published to RubyGems carried a .yardopts file whose '--load <path>' directive is applied as a CLI argument during RubyDoc.info's automated YARD documentation build, executing an attacker-supplied Ruby script (evil.rb, hack.rb, ssrf.rb, inject.rb, exploit.rb) on RubyDoc's own infrastructure and network egress. Over 100 packages in the campaign used this path. Confirmed exact syntax in [email protected]: '--load ./evil.rb'.