Malicious code in wallet-hd-derive (RubyGems)

The 'wallet-hd-derive' RubyGem version 0.9.1 is a malicious package masquerading as a crypto wallet utility. Its gemspec declares an extension script 'extconf.rb' which is executed automatically upon installation. This script decodes a base64-encoded Ruby payload that performs environment checks to evade sandbox and analysis environments by detecting CI environments, ephemeral hostnames, generated usernames, certain working directories, and low machine uptime. It also verifies the presence of developer-identifying files. After these checks, it double-forks a detached process, sleeps for 20 to 40 minutes, then opens a TCP connection to 45.138.12.177 on port 8089. It pipes a /bin/sh shell bidirectionally over this connection, effectively providing a remote operator with interactive shell access on the compromised developer or CI host. The gem's library exposes only two no-op methods and the README is unrelated, confirming the gem's sole purpose is to deliver this install-time backdoor.

Any developer or continuous integration environment that installs the 'wallet-hd-derive' gem version 0.9.1 may have a remote attacker gain interactive shell access on their system. This allows the attacker to execute arbitrary commands with the privileges of the installing user, potentially leading to full system compromise, data theft, or further lateral movement within the network.

No official patch or remediation is currently available. Users and organizations should avoid installing or using the 'wallet-hd-derive' gem version 0.9.1. Audit existing environments for installations of this gem and remove it immediately. Monitor for any network connections to the IP 45.138.12.177 on port 8089 and investigate any suspicious activity. Employ strict controls on dependency sources and consider using trusted package registries or internal mirrors. Patch status is not yet confirmed — check the vendor advisory or trusted security sources for updates.