Malicious code in btc-wallet-tools (RubyGems)

The 'btc-wallet-tools' RubyGems package versions 1.0.0 and 1.0.3 include a malicious native extension script 'ext/req_throttle_mini/extconf.rb' that runs automatically during 'gem install'. The script performs anti-analysis checks to avoid execution in CI environments, sandboxes, or short-uptime systems, and verifies the presence of developer files like '.ssh' or '.gitconfig'. If conditions are met, it decodes a Base64 Ruby payload and executes it in a detached double-forked process. This payload waits 20 to 40 minutes before opening a reverse shell connecting the host's /bin/sh to a remote IP (45.138.12.177) on TCP port 8090, reconnecting every 30 seconds. The Ruby code in the 'lib/' directory is a decoy. The malicious package was published by the RubyGems user 'reqthrottle_3474' along with 41 other similarly malicious gems on 2026-10-05.

Successful installation of the affected 'btc-wallet-tools' gem versions results in a remote attacker gaining persistent, interactive shell access to the victim's host system. This compromises the confidentiality, integrity, and availability of the host, allowing the attacker to execute arbitrary commands and potentially take full control of the system.

No official patch or remediation is currently documented for this malicious package. Users should avoid installing 'btc-wallet-tools' versions 1.0.0 and 1.0.3 from RubyGems. Remove any installations of this gem immediately and audit affected systems for signs of compromise. Monitor for connections to the IP 45.138.12.177 on TCP port 8090 and block this IP at network boundaries. Since this is a malicious package published on RubyGems, report it to RubyGems security teams for takedown and further investigation.