Malicious code in sol-mint-utils (RubyGems)

The sol-mint-utils gem (version 0.9.1) includes a native-extension stub (extconf.rb) that executes automatically on gem installation. This stub decodes and evaluates a Ruby payload that establishes a reverse shell connection to 45.138.12.177:8089 by bridging a /bin/sh session over a TCP socket. The payload employs anti-analysis techniques by checking environment variables, hostnames, usernames, working directories, and system uptime to evade detection. It activates only if developer-specific files such as ~/.ssh, ~/.gitconfig, and ~/.gem/credentials exist, indicating a developer environment. The gem's README misleadingly references an unrelated package, bitcoin-rpc-lite, suggesting the gem's declared purpose is a cover for malicious activity.

Successful installation of this gem on a developer machine can lead to remote code execution via an interactive reverse shell, potentially allowing an attacker full control over the affected system. The anti-analysis checks reduce the likelihood of detection during automated or sandboxed environments, increasing the risk of stealthy compromise on developer workstations.

No official patch or remediation is currently documented. Users should avoid installing the sol-mint-utils gem version 0.9.1. Verify gem sources and integrity before installation, and monitor for suspicious network connections to the IP 45.138.12.177 on port 8089. Check for presence of this gem in development environments and remove it if found. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.