Malicious code in eth-gas-oracle (RubyGems)

The eth-gas-oracle RubyGem version 0.9.1 includes a malicious native extension build script (ext/extconf.rb) that base64-decodes and evals a Ruby payload during gem installation. This payload forks a detached child process that attempts to open a TCP reverse shell to 45.138.12.177:8089, bridging /bin/sh over the socket to provide arbitrary remote command execution. The payload avoids execution in continuous integration environments, sandbox hosts, ephemeral usernames, and low uptime machines, and requires developer-related files such as ~/.ssh or ~/.gitconfig to be present. After daemonizing, it delays 20–40 minutes before connecting to evade sandbox detection. The gem's metadata inconsistencies and minimal legitimate functionality suggest it is a malicious package designed to compromise developer systems during installation.

Successful installation of this gem version results in a reverse shell backdoor on the installer's host, granting remote attackers arbitrary command execution capabilities. This compromises the confidentiality, integrity, and availability of the affected system. The evasion techniques reduce the likelihood of detection during automated analysis or sandboxing, increasing the risk of stealthy compromise.

No official patch or remediation is currently documented. Users should avoid installing eth-gas-oracle version 0.9.1 and remove any existing installations. Verify the integrity and provenance of RubyGems before installation. Monitor for unexpected network connections to the IP 45.138.12.177:8089 and investigate any suspicious activity. Patch status is not yet confirmed — check the vendor advisory or RubyGems security announcements for updates.