Malicious code in erc20-approve-audit (RubyGems)

The 'erc20-approve-audit' RubyGem version 0.9.1 includes a native extension script that, upon installation, base64-decodes a Ruby payload and launches it as a detached background process. This payload opens a TCP socket to 45.138.12.177:8089 and pipes a local /bin/sh shell to it in an infinite reconnect loop, effectively providing remote shell access to the installer's host. The execution is gated by anti-analysis checks that suppress the payload in continuous integration environments, sandboxed or ephemeral hosts, analyst-like usernames and directories, and machines with uptime under 1800 seconds. Activation requires the presence of developer signal files such as ~/.ssh or ~/.gitconfig. The gem's metadata is misleading, with the name 'erc20-approve-audit' but internal references to 'bitcoin-rpc-lite' and minimal functional code, indicating malicious intent.

Successful installation of this gem version results in a remote attacker gaining persistent shell access to the host machine, potentially allowing full control over the system. The anti-analysis features reduce the likelihood of detection during automated or sandboxed testing, increasing the risk of stealthy compromise in developer environments.

No official patch or remediation is currently documented. Users should avoid installing version 0.9.1 of the 'erc20-approve-audit' gem. Verify the authenticity and integrity of RubyGems before installation. Monitor for unexpected network connections to the IP 45.138.12.177 on port 8089 and investigate any suspicious processes spawned during gem installation. Check vendor advisories or RubyGems security notices for updates or removal of the malicious package.