Malicious code in nft-metadata-resolver (RubyGems)

The nft-metadata-resolver RubyGem version 0.9.1 includes a native-extension script (ext/nft_metadata_resolver/extconf.rb) that is automatically executed by RubyGems during installation. This script contains a base64-encoded Ruby payload that is decoded and executed via eval inside a detached child process. The payload opens a TCP connection to 45.138.12.177:8089 and bridges a /bin/sh shell to this socket, effectively providing the remote endpoint with an interactive shell on the victim host. The execution is conditioned on sandbox evasion checks that detect CI environments, ephemeral hostnames, analyst-like usernames, and short uptimes, firing only on developer-like home directories. The package metadata is inconsistent, advertising itself as nft-metadata-resolver but referencing bitcoin-rpc-lite in the README and makefile target, with no genuine native C/C++ code present. The extconf.rb script's sole purpose is to decode and execute the embedded malicious payload.

Successful installation of this malicious gem results in remote code execution on the installer's system, providing the attacker with an interactive shell. This can lead to full system compromise, data theft, or further malicious activity. The sandbox evasion techniques reduce the likelihood of detection during automated analysis or in ephemeral environments, increasing the risk of targeted compromise.

No official patch or remediation is currently documented for this malicious package. Users should avoid installing nft-metadata-resolver version 0.9.1 and remove it if already installed. Verify the authenticity of RubyGems packages before installation, and consider using trusted sources or package signing verification. Monitor for any unexpected network connections to the IP 45.138.12.177 and investigate any suspicious activity related to this gem. Patch status is not yet confirmed — check the vendor advisory or RubyGems security announcements for updates.