Malicious code in mev-sandwich-detect (RubyGems)

The 'mev-sandwich-detect' RubyGem version 0.9.1 is a malicious stub gem that performs install-time code execution by decoding and eval()ing an embedded Ruby payload. This payload creates a reverse shell by opening a TCP socket to 45.138.12.177:8089 and bridging it to /bin/sh, allowing remote command execution on the host machine. Execution is conditioned on anti-analysis checks such as environment detection (CI, sandbox, analyst usernames), uptime greater than 1800 seconds, and presence of developer credential files. The native extension declared in the gemspec is a vector for lifecycle execution rather than a genuine compiled addon. The gem's README is misleadingly labeled, and the main library code is a no-op, indicating the package's sole purpose is malicious.

Successful installation of this gem results in remote code execution on the host system via a reverse shell to a remote attacker-controlled server. This compromises the confidentiality, integrity, and availability of the affected system. The attacker gains interactive shell access, enabling arbitrary command execution. The anti-analysis and delay mechanisms increase the likelihood of persistent undetected compromise in developer environments.

No official patch or remediation is available for this malicious package. The best mitigation is to avoid installing 'mev-sandwich-detect' version 0.9.1 and to audit existing systems for its presence. Remove the gem if found and investigate any suspicious network connections to 45.138.12.177 on port 8089. Employ supply chain security measures such as verifying gem provenance and using trusted sources. Monitor for similar malicious packages in RubyGems repositories.