Malicious code in eth-address-utils (RubyGems)

The 'eth-address-utils' RubyGems package (versions 1.0.0 and 1.0.3) includes a native extension script 'ext/req_throttle_mini/extconf.rb' that runs automatically during 'gem install'. This script performs environment checks to evade analysis and sandbox detection, then decodes a Base64-encoded Ruby payload. The payload forks into a detached background process, sleeps 20 to 40 minutes, and opens a reverse shell to a hardcoded IP address (45.138.12.177) on TCP port 8090. This reverse shell bridges a shell process to the remote attacker, enabling full remote code execution on the victim system with the privileges of the installing user. The package masquerades as an Ethereum address utility but is a disguised remote-access implant. The RubyGems account 'reqthrottle_3474' published this and 41 other similarly malicious gems on 2026-10-05.

Successful installation of this package on a developer workstation results in a persistent reverse shell connection to a remote attacker, granting full remote code execution capabilities under the installing user's privileges. This compromises the confidentiality, integrity, and availability of the affected system and potentially the development environment.

No official patch or remediation is currently available. Users should immediately avoid installing 'eth-address-utils' versions 1.0.0 and 1.0.3. Remove any installations of this package and investigate systems for signs of compromise, especially if the package was installed on developer workstations. Monitor for unexpected outbound connections to the IP 45.138.12.177 on TCP port 8090. Check RubyGems sources and avoid gems published by the 'reqthrottle_3474' account. Patch status is not yet confirmed — check the vendor advisory or RubyGems security announcements for updates.