Malicious code in staking-apr-fetcher (RubyGems)

The 'staking-apr-fetcher' RubyGem (version 0.9.1) declares a native extension whose build script (extconf.rb) decodes a base64-encoded Ruby payload and executes it via eval during gem installation. This payload double-forks a detached background process that opens a TCP connection to a hardcoded IP address (45.138.12.177) on port 8089. It then proxies data bidirectionally between this socket and a locally spawned /bin/sh shell, effectively granting remote interactive shell access to the attacker. The payload activates only if the environment does not resemble CI, sandbox, or analyst environments, and only if system uptime exceeds 1800 seconds and certain developer files exist. The gem is a malicious package masquerading as a staking-related tool but contains no legitimate functionality.

Successful installation of this gem results in a persistent backdoor on the victim's machine, allowing remote attackers interactive shell access. This compromises system confidentiality, integrity, and availability. The backdoor evades detection by avoiding execution in analysis or sandbox environments and requires certain conditions to be met, increasing stealth. There is no legitimate functionality in the package, indicating it is solely designed for malicious purposes.

No official patch or remediation is currently documented. Users should avoid installing the 'staking-apr-fetcher' gem version 0.9.1. Remove any installations of this gem immediately and investigate systems for signs of compromise, especially connections to 45.138.12.177:8089 and spawned /bin/sh processes. Monitor for suspicious background processes and network activity. Check vendor advisories or trusted security sources for updates or official fixes.