Malicious code in multichain-rpc (RubyGems)

The multichain-rpc RubyGem (version 0.9.1) includes a malicious payload in its extconf.rb script, which runs automatically during gem installation as a native extension build step. This payload base64-decodes a Ruby script and executes it via eval inside a detached background process. It opens a TCP connection to a hardcoded IP (45.138.12.177) on port 8089, bridging it to /bin/sh, effectively granting the remote attacker an interactive shell on the victim's machine. The malicious code employs developer-host heuristics (checking for files like ~/.ssh, ~/.gitconfig, ~/.npmrc, ~/.gem/credentials, ~/.bundle, and system uptime) and anti-analysis checks to avoid running in CI, ephemeral, sandbox, or generated-user environments. It also delays execution by 20 to 40 minutes to evade detection. The rest of the gem is a cover, exporting only stub methods and containing misleading documentation and native extension declarations without actual C source code.

Successful installation of this gem on a developer workstation results in a full remote shell being granted to the attacker, allowing complete control over the affected machine. This can lead to unauthorized access, data theft, system compromise, and further lateral movement within the victim's environment.

No official patch or remediation is currently documented. Users should avoid installing version 0.9.1 of the multichain-rpc gem. Inspect and remove any installations of this gem from developer workstations. Monitor for suspicious network connections to the IP 45.138.12.177 on port 8089. Since the malicious code is embedded in the gem installation process, do not install untrusted or unknown RubyGems without verification. Patch status is not yet confirmed — check the vendor advisory or RubyGems security announcements for updates.