Malicious code in bitcoin-rpc-lite (RubyGems)

The bitcoin-rpc-lite gem's native extension script ext/req_throttle_mini/extconf.rb runs during gem installation and performs environment checks to evade CI and sandbox detection. If conditions indicate a real developer environment (e.g., presence of .ssh or .gitconfig), and system uptime exceeds 30 minutes, it decodes a Base64 Ruby payload that forks twice to create a detached process. This process sleeps 20 to 40 minutes before opening a reverse shell connecting /bin/sh to the attacker-controlled IP 45.138.12.177 on TCP port 8089. The shell reconnects every 30 seconds, providing persistent remote access. The Ruby code in the lib/ directory is a decoy. The malicious gem was published by the RubyGems account reqthrottle_3474 on 2026-10-05 along with 41 other similarly malicious gems.

Successful installation of the affected gem versions results in remote code execution on the host machine via a reverse shell to an attacker-controlled server. This allows the attacker to execute arbitrary commands with the privileges of the installing user, potentially leading to full system compromise. The evasion techniques and delayed activation increase the likelihood of successful stealthy exploitation.

No official patch or remediation is currently documented. Users should immediately remove and avoid installing the bitcoin-rpc-lite gem versions 1.0.0 and 1.0.3. Audit systems for any signs of compromise if these versions were installed. Monitor for network connections to the IP 45.138.12.177 on TCP port 8089. Since this is a malicious package published on RubyGems, rely on trusted sources and verify gem integrity before installation. Patch status is not yet confirmed — check the vendor advisory or RubyGems security announcements for updates.