Malicious code in ton-jetton-tools (RubyGems)

The 'ton-jetton-tools' RubyGem version 0.9.1 includes a malicious native-extension build script that executes a base64-encoded Ruby payload during installation. This payload forks a detached child process that opens a TCP connection to 45.138.12.177:8089, bridging the socket to /bin/sh and providing an interactive shell to the remote operator. Execution is conditioned on anti-analysis heuristics that detect CI or sandbox environments and presence of developer artifacts such as SSH keys and git configuration files. The gem's declared name and README content are inconsistent, suggesting deliberate obfuscation.

Successful installation of this gem version results in remote code execution on the host machine via a reverse shell, potentially allowing an attacker full control over the affected system. The malicious payload is designed to evade automated analysis environments and targets developer machines with specific artifacts, increasing the risk to development environments.

No official patch or remediation is currently documented. Users should avoid installing version 0.9.1 of 'ton-jetton-tools'. Verify gem sources and integrity before installation. Consider removing the gem if already installed and investigate any suspicious network connections to the indicated IP address. Monitor for updates from the vendor or RubyGems regarding remediation.