Malicious code in hd-wallet-generator (RubyGems)

The hd-wallet-generator RubyGem version 0.9.1 includes a malicious native extension build script (ext/hd_wallet_generator/extconf.rb) that executes a Base64-encoded payload via eval() during gem installation. This payload establishes a TCP connection to 45.138.12.177:8089 and pipes an interactive /bin/sh shell over it, granting remote shell access. The execution is performed in a double-forked detached child process with a delayed connection to obscure timing. The payload activates only after passing several evasion checks, including absence of CI environment variables, hostname and username pattern checks, working directory exclusions, machine uptime over 30 minutes, and presence of developer-related files. The extension build script does not compile any native code, serving only as a cover for the malicious payload. The package metadata and README description mismatch further suggest the package is a disguised dropper.

Successful installation of this package version results in remote code execution on the installer's system via a reverse shell to a hardcoded attacker-controlled IP address. This compromises the confidentiality, integrity, and availability of the affected host by allowing an attacker interactive shell access. The evasion techniques reduce the likelihood of detection during automated or sandboxed installs, increasing the risk of stealthy compromise.

No official patch or remediation is currently documented. Users should avoid installing hd-wallet-generator version 0.9.1. Verify package integrity and source before installation. Consider removing the package if already installed. Monitor for any unauthorized network connections to the IP 45.138.12.177:8089 and investigate any suspicious activity. Patch status is not yet confirmed — check the vendor advisory or RubyGems security announcements for updates.