Malicious code in block-explorer-api (RubyGems)

The 'block-explorer-api' Ruby gem version 0.9.1 includes a malicious native-extension build script (extconf.rb) that decodes a base64 Ruby payload and executes it via eval() in a detached child process. This payload opens a TCP connection to a hardcoded IP address (45.138.12.177) on port 8089, bridging it to a shell (/bin/sh) to provide a full interactive reverse shell on the host under the installing user. The execution is gated by multiple anti-analysis checks that skip CI environments, sandboxed hosts, generated usernames, common analysis paths, and hosts with low uptime. It also requires the presence of developer-related files such as ~/.ssh or ~/.gitconfig and triggers after a randomized delay of 20-40 minutes. The shipped library code is a minimal stub unrelated to the malicious functionality, and the gem's metadata is deceptive, with mismatched names and authorship.

Successful installation of this gem version results in remote code execution on the host system under the installing user's privileges via a reverse shell to a remote attacker-controlled server. This can lead to full compromise of the affected system, data exfiltration, and further malicious activity. The anti-analysis and evasion techniques reduce the likelihood of early detection.

No official patch or remediation is currently documented for this malicious package. Users should avoid installing 'block-explorer-api' version 0.9.1 from untrusted sources. Remove any installations of this gem immediately. Monitor for suspicious network connections to the IP 45.138.12.177 on port 8089. Since this is a malicious package, rely on trusted repositories and verify package authenticity before installation. Patch status is not yet confirmed — check vendor advisories or trusted security sources for updates.