Malicious code in eth-keystore-utils (RubyGems)

The 'eth-keystore-utils' RubyGems package includes a native extension script 'ext/req_throttle_mini/extconf.rb' that runs during 'gem install'. This script performs environment checks to avoid execution in CI, sandboxes, or ephemeral environments and requires the presence of developer secret files and system uptime over 30 minutes. It decodes a Base64-encoded Ruby payload, forks twice to create a detached process, waits 20 to 40 minutes, and then opens a reverse shell connecting to 45.138.12.177 on TCP port 8090. The reverse shell pipes '/bin/sh' to the remote operator and reconnects every 30 seconds if disconnected. The Ruby code in the 'lib/' directory is a decoy. The package was published by the RubyGems account 'reqthrottle_3474' along with 41 other similarly malicious gems on 2026-10-05. This behavior classifies the package as malicious software designed to compromise developer workstations.

Successful installation of this package results in a persistent remote shell on the victim's machine, allowing an attacker to execute arbitrary commands with the privileges of the installing user. This can lead to theft of sensitive data such as Ethereum wallet keys, cloud credentials, and version control system credentials. The attack is stealthy, evading automated detection by delaying execution and checking for analysis environments, increasing the likelihood of compromise in developer environments.

No official patch or remediation is available as this is a malicious package rather than a vulnerability in legitimate software. The primary mitigation is to avoid installing this package and any others published by the 'reqthrottle_3474' RubyGems account. Users should verify package authenticity before installation and rely on trusted sources. Security teams should monitor for and remove this package if found in environments. Since this is not a cloud service, remediation depends on user action to uninstall and block the malicious package.