Malicious code in gas-refuel-bridge (RubyGems)

The 'gas-refuel-bridge' RubyGem version 0.9.1 includes a malicious native extension build script (extconf.rb) that base64-decodes and evals a Ruby payload during gem installation. This payload double-forks a background process that waits 20-40 minutes before opening a TCP socket to 45.138.12.177:8089, creating a persistent reverse shell to /bin/sh. Execution is conditioned on anti-analysis checks, skipping CI environments, ephemeral hostnames, short system uptime, and requiring developer identity markers such as presence of ~/.ssh or ~/.gitconfig. The gem's visible code and documentation are decoys, with the extension hook being the sole functional payload.

Systems installing version 0.9.1 of the 'gas-refuel-bridge' gem are at risk of having a persistent reverse shell established to a remote attacker-controlled server, enabling unauthorized remote command execution. The anti-analysis gating reduces detection likelihood in automated or ephemeral environments but targets developer machines. This compromises confidentiality, integrity, and availability of affected hosts.

No official patch or remediation is currently documented. Users should avoid installing version 0.9.1 of the 'gas-refuel-bridge' gem. If already installed, remove the gem and inspect affected systems for signs of compromise, including active reverse shells or suspicious background processes. Monitor network connections to the IP 45.138.12.177 on port 8089. Patch status is not yet confirmed — check the vendor advisory or RubyGems security announcements for updates.