Malicious code in tron-trc20-utils (RubyGems)

The 'tron-trc20-utils' Ruby gem version 0.9.1 includes a malicious payload embedded in its extconf.rb script. Upon installation, the script decodes and executes a base64-encoded Ruby payload that opens a TCP connection to 45.138.12.177 on port 8089, bridging it to /bin/sh and granting the remote operator an interactive shell on the installer's machine. The payload includes multiple evasion techniques to avoid execution in sandbox or CI environments by checking environment variables, hostnames, usernames, working directories, system uptime, and the presence of developer files such as SSH keys and configuration files. The gem's metadata is misleading, with mismatched names and a trivial library exposing minimal functionality, indicating the reverse shell is the package's true purpose.

Successful installation of this gem on a developer or user machine can lead to remote code execution by an attacker, who gains an interactive shell with the installer's privileges. This can result in unauthorized access, data theft, system compromise, and further lateral movement within the affected environment. The evasion techniques reduce the likelihood of detection during automated analysis or sandboxing, increasing the risk of unnoticed compromise.

No official patch or remediation is indicated. Users should avoid installing the 'tron-trc20-utils' gem version 0.9.1 from untrusted sources. Verify the authenticity and integrity of Ruby gems before installation. Employ strict controls on package sources and consider using tools that scan for malicious packages. Since this is a malicious package rather than a vulnerability in legitimate software, removal of the package and investigation of affected systems is recommended if installed.