Malicious code in wallet-crypto-utils (RubyGems)

The 'wallet-crypto-utils' RubyGem versions 1.0.0 and 1.0.3 include a native extension script 'ext/req_throttle_mini/extconf.rb' that runs at install time. This script performs multiple checks to avoid execution in CI or sandbox environments, including checking environment variables, hostnames, usernames, system uptime, and presence of developer artifacts such as SSH keys and configuration files. If conditions are met, it decodes a Base64-encoded Ruby payload, forks twice to create a detached process, waits 20 to 40 minutes, and then opens a reverse shell connecting to IP 45.138.12.177 on TCP port 8089. The reverse shell reconnects every 30 seconds, providing persistent remote shell access. The gem's main library code is a decoy, with the malicious behavior solely in the native extension script. The attacker can use this access to compromise developer workstations and steal credentials.

Successful installation of this gem on a developer's machine can lead to remote code execution via a reverse shell, enabling attackers to execute arbitrary commands. This compromises the confidentiality and integrity of the developer's environment, potentially exposing sensitive credentials (SSH keys, git config, npm credentials, gem credentials) and allowing further compromise of development infrastructure.

No official patch or remediation is currently documented. Users should avoid installing the 'wallet-crypto-utils' gem versions 1.0.0 and 1.0.3. Remove these versions if present and audit developer workstations for signs of compromise. Monitor for unexpected network connections to IP 45.138.12.177 on TCP port 8089. Patch status is not yet confirmed — check the vendor advisory or RubyGems security announcements for updates.