Malicious code in wallet-balance-scanner (RubyGems)

The wallet-balance-scanner RubyGem version 0.9.1 includes a malicious native extension script (extconf.rb) that executes automatically during gem installation. Instead of building native code, this script decodes a base64 payload and launches it in a detached process that opens a TCP connection to a hardcoded IP address (45.138.12.177) on port 8089. This connection provides a shell to the attacker, effectively creating a reverse shell on the victim's machine. The payload activates only on machines that appear to be real developer environments, checking for the presence of SSH keys, Git configuration, npm credentials, gem credentials, and bundle files, as well as host uptime and environment heuristics to evade analysis and sandbox detection. The gem's main Ruby file and README are stubs unrelated to the declared functionality, indicating the gem is a cover for the malicious payload.

Successful installation of this gem on a developer workstation results in the attacker gaining remote shell access to the host. This compromises the confidentiality, integrity, and availability of the affected system, potentially allowing the attacker to execute arbitrary commands, exfiltrate data, or move laterally within the network. The targeted activation on developer machines increases the risk of supply chain compromise or further malicious activity within development environments.

No official patch or remediation is currently documented. Users should avoid installing the wallet-balance-scanner gem version 0.9.1. Verify the integrity and source of RubyGems before installation. Consider removing the gem if already installed and investigate any network connections to the IP 45.138.12.177:8089. Monitor developer workstations for signs of compromise. Patch status is not yet confirmed — check the vendor advisory or RubyGems security updates for current remediation guidance.