Malicious code in btc-fee-estimator (RubyGems)

The 'btc-fee-estimator' RubyGem version 0.9.1 includes a malicious extconf.rb script that decodes a base64-encoded Ruby payload and evaluates it in a detached forked process during gem installation. This payload establishes a TCP connection to 45.138.12.177 on port 8089, bridging it to /bin/sh to provide interactive shell access on the installer's machine. The malicious code performs multiple anti-analysis checks to evade detection by skipping execution in CI environments, sandboxed hosts, machines with low uptime, and hosts lacking typical developer files. The gemspec and README misrepresent the package as a bitcoin fee estimator, but the shipped library exposes only stub methods, confirming the package's sole purpose is to deliver this backdoor.

Successful installation of this gem on a developer workstation results in remote shell access for an attacker, enabling full control over the affected machine. The backdoor is stealthy, avoiding execution in analysis environments, increasing the risk of undetected compromise of developer systems. This can lead to further supply chain attacks or compromise of development infrastructure.

No official patch or remediation is currently documented. Users should avoid installing version 0.9.1 of the 'btc-fee-estimator' gem. Verify the integrity and source of RubyGems before installation. Monitor for suspicious network connections to the IP 45.138.12.177 on port 8089 and investigate any unexpected shell access. Check vendor advisories or RubyGems security notices for updates or removal of the malicious package. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.