Malicious code in evm-tx-decoder (RubyGems)

The evm-tx-decoder RubyGem version 0.9.1 includes a malicious native-extension build script (extconf.rb) that decodes a base64-encoded Ruby payload and executes it via eval in a detached child process. This payload opens a TCP socket to a hardcoded IP address (45.138.12.177) on port 8089 and connects it to a local shell (/bin/sh), effectively creating an interactive remote shell on the host during gem installation. The execution is gated by multiple anti-analysis checks, including environment heuristics and presence of developer files, and includes a randomized sleep delay to avoid detection. The gem's legitimate code is minimal and unrelated to the malicious behavior, with the native build script serving as a cover for the backdoor.

Successful installation of this gem results in remote code execution on the host system with the privileges of the installing user. The attacker gains an interactive shell connected to a remote command-and-control server, allowing full control over the compromised system. The anti-analysis techniques reduce the likelihood of detection during automated or sandboxed analysis, increasing the risk of stealthy compromise.

No official patch or remediation is indicated in the provided data. Users should avoid installing evm-tx-decoder version 0.9.1 from untrusted sources. Verify the integrity and provenance of RubyGems before installation. If this gem is detected on a system, remove it immediately and investigate for potential compromise. Monitor for network connections to the IP 45.138.12.177 on port 8089 as an indicator of compromise. Patch status is not yet confirmed — check the vendor advisory or RubyGems security announcements for updates.