Malicious code in web3-signer-kit (RubyGems)

The web3-signer-kit RubyGem version 0.9.1 includes a malicious extconf.rb script that, upon installation, decodes and evals a base64-encoded payload. This payload creates a TCP socket connection to 45.138.12.177:8089 and bridges a /bin/sh shell over the socket, allowing remote code execution by the attacker controlling that endpoint. The execution is delayed by a randomized sleep and gated by sandbox evasion checks that look for CI environments, ephemeral hosts, analyst usernames, and require developer artifacts such as ~/.ssh, ~/.gitconfig, and ~/.gem/credentials. The gem provides no real functionality and serves solely as a dropper for this backdoor.

Successful installation of this gem on a developer or analyst machine can lead to full remote code execution by an attacker, compromising the host system. The attacker gains a remote shell with the privileges of the installing user. The evasion techniques reduce the likelihood of detection in automated or sandboxed environments but do not eliminate risk on targeted developer machines.

No official patch or remediation is currently documented. Users should avoid installing the web3-signer-kit gem version 0.9.1. Remove any instances of this gem from systems and audit for signs of compromise if it was installed. Monitor for connections to the IP 45.138.12.177 on port 8089. Since this is a malicious package, rely on trusted sources and verify package integrity before installation. Patch status is not yet confirmed — check the vendor advisory or RubyGems security notices for updates.