Malicious code in airdrop-eligibility-check (RubyGems)

The 'airdrop-eligibility-check' RubyGem version 0.9.1 includes a malicious native extension that executes during gem installation. Its extconf.rb script decodes a base64 Ruby payload and evaluates it inside a detached double-forked child process after a randomized 20–40 minute delay. The payload establishes a TCP connection to 45.138.12.177:8089, spawning a /bin/sh shell bridged over the socket, effectively providing an interactive reverse shell on the victim's machine. Execution is gated by anti-analysis checks that prevent triggering in continuous integration environments, ephemeral hostnames, generated usernames, analysis paths, and systems with uptime under 1800 seconds. Additionally, it only activates if developer credential files such as ~/.ssh or ~/.gitconfig are present. The gem's metadata and contents do not align with its name, indicating no legitimate functionality and confirming its use as a malicious dropper.

Successful installation of this gem on a developer's machine can result in remote code execution via an interactive reverse shell to an attacker-controlled server. This allows the attacker to execute arbitrary commands with the privileges of the installing user. The anti-analysis and gating mechanisms increase the likelihood of evading automated detection and sandbox environments, targeting developer environments with credential files. This can lead to compromise of sensitive development credentials and potentially broader system compromise.

No official patch or remediation is currently documented. Users should avoid installing the 'airdrop-eligibility-check' gem version 0.9.1. Verify the authenticity and source of RubyGems before installation. Employ strict controls on gem sources and consider scanning gems for malicious code prior to installation. Monitor for any unexpected network connections to the IP address 45.138.12.177 on port 8089. Patch status is not yet confirmed — check the vendor advisory or RubyGems security announcements for updates.