Malicious code in seed-phrase-validator (RubyGems)

The seed-phrase-validator gem (version 0.9.1) declares a native extension but includes no native source code. Instead, its extconf.rb script executes at gem install time, decoding and evaluating a base64-encoded Ruby payload inside a detached fork process. This payload opens a TCP socket to 45.138.12.177:8089 and bridges it to /bin/sh, effectively granting an interactive remote shell on the installer's machine. Execution is conditioned on the presence of developer artifacts such as ~/.ssh, ~/.gitconfig, ~/.npmrc, ~/.gem/credentials, or ~/.bundle, and avoids CI runners, sandbox environments, and low-uptime machines. The package's metadata is inconsistent, with mismatched names and targets, suggesting malicious intent.

Successful installation of this gem version on a developer machine can lead to remote code execution via an interactive shell accessible to an attacker at the hardcoded IP address. This compromises the host system's confidentiality, integrity, and availability. The targeted execution conditions reduce detection likelihood but increase risk to developer environments.

No official patch or remediation is currently documented. Users should avoid installing seed-phrase-validator version 0.9.1. Verify package integrity and source before installation. Consider removing the gem if already installed and investigate any suspicious network connections to the IP 45.138.12.177 on port 8089. Monitor for unauthorized remote shell activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.