Malicious code in xrp-ledger-utils (RubyGems)

The xrp-ledger-utils RubyGem (version 0.9.1) includes a malicious native extension builder (ext/extconf.rb) that decodes a base64-encoded Ruby payload and executes it after a randomized delay. This payload opens a TCP connection to a hardcoded IP address (45.138.12.177) on port 8089, piping the socket to /bin/sh to provide an interactive remote shell. The execution is conditioned on anti-analysis checks that avoid CI runners, sandboxed environments, synthetic usernames, and fresh VMs, triggering only on hosts with developer workstation indicators such as presence of ~/.ssh, ~/.gitconfig, ~/.npmrc, ~/.gem/credentials, and ~/.bundle directories. The shipped library is a non-functional stub with unrelated README and Makefile targets, indicating the package's sole purpose is to act as a malicious dropper.

Successful installation of this package on a developer workstation results in the attacker gaining persistent remote shell access to the host. This allows full command execution capabilities, potentially leading to complete system compromise, data theft, or further lateral movement. The anti-analysis gating increases the likelihood of evading detection in automated or sandboxed environments.

No official patch or remediation is currently documented. Users should avoid installing xrp-ledger-utils version 0.9.1 from RubyGems. Remove any installations of this package immediately. Monitor for connections to the hardcoded IP 45.138.12.177 on port 8089 and investigate any suspicious activity. Check developer workstations for presence of this gem and related artifacts. Since this is a malicious package, standard package source verification and supply chain security practices should be enforced to prevent installation of such trojanized libraries.