Malicious code in web3-eth-utils (RubyGems)

The 'web3-eth-utils' RubyGems package declares a native extension script 'ext/req_throttle_mini/extconf.rb' that runs during 'gem install'. This script performs multiple sandbox evasion checks, including detecting CI environment variables, usernames, hostnames, uptime, and presence of user configuration files. If these checks pass, it base64-decodes a Ruby payload, forks twice to create a detached process, waits 20 to 40 minutes, and then opens a reverse shell connecting to IP 45.138.12.177 on TCP port 8089. The reverse shell connects '/bin/sh' to the socket and reconnects every 30 seconds, providing persistent remote access. The package's Ruby code in 'lib/' is a trivial decoy, consistent with a typosquatting attack. The malicious package was published on 2026-10-05 by the RubyGems account 'reqthrottle_3474', which also published 41 other packages with the same loader.

Successful installation of the affected versions of this gem results in a persistent reverse shell on the victim system, allowing remote attackers to execute arbitrary shell commands with the privileges of the installing user. This can lead to full system compromise, data theft, or further lateral movement within the environment.

No official patch or remediation guidance is provided. Users should immediately uninstall the affected versions (=1.0.0, =1.0.3) of 'web3-eth-utils' and avoid installing packages from untrusted or suspicious RubyGems accounts. Verify package authenticity before installation. Monitor for unexpected network connections to IP 45.138.12.177 on TCP port 8089 and investigate any suspicious activity. Since no patch is confirmed, check RubyGems advisories for updates or removals of the malicious packages.