Malicious code in crypto-mnemonic-tools (RubyGems)

The 'crypto-mnemonic-tools' RubyGems package includes a native extension script 'ext/req_throttle_mini/extconf.rb' that runs during 'gem install'. This script performs anti-analysis checks to avoid execution in CI, sandbox, or ephemeral environments by inspecting environment variables, hostnames, usernames, working directories, system uptime, and presence of developer artifacts. If conditions are met, it decodes a Base64 Ruby payload, forks twice to create a detached daemon, sleeps for 20 to 40 minutes, and then opens a reverse shell connecting '/bin/sh' to TCP port 8090 on IP 45.138.12.177. The shell reconnects every 30 seconds to maintain access. The extension has no native C sources and exists solely as an execution vector. The package was published by the RubyGems account 'reqthrottle_3474' along with 41 other similarly malicious gems on 2026-10-05.

Successful installation of this gem on a developer's machine can result in remote code execution via a reverse shell, allowing an attacker to gain interactive shell access. This compromises the confidentiality and integrity of the affected system. The attack is stealthy, evading CI and sandbox detection and delaying execution to bypass install-time monitoring.

No official patch or remediation is currently documented. Users should avoid installing the 'crypto-mnemonic-tools' gem versions 1.0.0 and 1.0.3. Remove any installations of this gem and related packages published by the 'reqthrottle_3474' account. Monitor for suspicious outbound connections to IP 45.138.12.177 on TCP port 8090. Check vendor advisories for updates or official guidance. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.