Malicious code in dex-router-abis (RubyGems)

The dex-router-abis RubyGem version 0.9.1 includes a malicious extconf.rb script that runs automatically during gem installation. This script decodes a base64-encoded Ruby payload and executes it via a double-forked, detached process that sleeps for 20-40 minutes before opening a TCP reverse shell from /bin/sh to the IP 45.138.12.177 on port 8089. The execution is conditional, checking for environment variables to avoid CI/sandbox environments and probing for developer secret files such as ~/.ssh, ~/.gitconfig, ~/.gem/credentials, ~/.npmrc, and ~/.bundle. The gem's metadata misleads by identifying as 'bitcoin-rpc-lite' while the actual package name is dex-router-abis, indicating reuse of a dropper template. Successful installation grants the attacker interactive shell access to the host, exposing sensitive developer credentials and keys.

Successful installation of this malicious gem on a developer's machine results in the attacker gaining interactive shell access to the host system. This access can expose local SSH keys, RubyGems publishing credentials, and other sensitive developer secrets, potentially leading to further compromise of development environments and software supply chain integrity.

No patch or official fix information is provided for this malicious package. The best mitigation is to avoid installing the dex-router-abis gem version 0.9.1 from untrusted sources. Verify the authenticity and integrity of RubyGems before installation. Monitor for suspicious network connections to the IP 45.138.12.177 on port 8089 and remove any installations of this gem. Consider using dependency scanning tools to detect malicious packages.