The eth-gas-oracle RubyGem version 0.9.1 contains malicious code embedded in its native extension build script. During installation, it decodes and executes a hidden Ruby payload that establishes a reverse shell to a hardcoded IP address, allowing remote command execution on the installer's machine. The payload includes evasion techniques to avoid detection in sandbox or CI environments and requires the presence of developer artifacts to activate. The package metadata is inconsistent, indicating it is a disposable vehicle for malicious activity rather than legitimate functionality.
The xrp-ledger-utils RubyGem version 0.9.1 contains malicious code embedded in its native extension builder. This code decodes and executes a base64-encoded Ruby payload that establishes a persistent remote shell connection to a hardcoded command-and-control server. The payload activates only on developer workstations, bypassing analysis environments, and provides an interactive shell to the attacker. The package itself has no legitimate functionality and is a malicious dropper disguised under unrelated project files.
The multichain-rpc RubyGem version 0.9.1 contains malicious code embedded in its extconf.rb file. This code executes during gem installation, launching a background process that connects to a remote host and provides an interactive shell to an attacker. The payload uses evasion techniques to avoid detection in developer and CI environments and delays execution by 20-40 minutes. The gem's visible code is a decoy, with stub methods and misleading documentation.
The RubyGem 'staking-apr-fetcher' version 0.9.1 contains malicious code that executes a backdoor during installation. The gem's build script decodes and runs a hidden Ruby payload that creates a background process connecting to a remote host, providing interactive shell access to the attacker. The payload includes anti-analysis checks to avoid detection in CI environments, sandboxes, or analyst setups. The package has no legitimate functionality and is solely designed to deliver this install-time backdoor.
The web3-signer-kit RubyGem version 0.9.1 contains malicious code embedded in its extconf.rb file. During gem installation, it decodes and executes a base64 payload that establishes a remote shell connection to a hardcoded IP address, enabling full remote code execution. The payload includes sandbox evasion techniques and requires the presence of developer artifacts before activating. The gem itself has no legitimate functionality and acts as a decoy to deliver this malicious payload.
The RubyGem package nft-metadata-resolver version 0.9.1 contains a malicious native-extension script that executes a hidden payload during installation. This payload establishes a reverse shell connection to a hardcoded IP address, allowing remote code execution on the host. The malicious code includes sandbox evasion techniques to avoid detection in analysis environments. The package's metadata is inconsistent, misleading users about its true purpose.
The Ruby gem 'tron-trc20-utils' version 0.9.1 contains malicious code that executes a reverse shell during installation. The gem's extconf.rb file decodes and evaluates a base64-encoded payload that connects to a remote IP address and provides an interactive shell to the attacker. The malicious behavior is designed to evade sandbox and continuous integration environments by checking for specific environment variables, hostnames, usernames, working directories, system uptime, and the presence of developer artifacts. The gem's metadata and contents are inconsistent, indicating deception. This reverse shell is the primary functionality of the package, posing a significant security risk to users who install it.
The RubyGem 'perp-funding-rates' version 0.9.1 contains malicious code in its native-extension script that executes during installation. The script decodes and evaluates a hidden Ruby payload that establishes a reverse shell to a hardcoded command-and-control server, allowing remote code execution on the installer's machine. The payload activates only on developer workstations or build systems identified by the presence of specific user files, indicating a targeted attack. This behavior is obfuscated and delayed to evade detection.
The RubyGem 'wallet-hd-derive' version 0.9.1 contains malicious code that executes a backdoor during installation. The gemspec triggers execution of an encoded Ruby payload that performs sandbox evasion checks, then establishes a delayed reverse shell to a remote IP, allowing remote command execution on the host. The gem's library exposes only no-op methods and a misleading README, indicating it is solely a delivery vehicle for this backdoor.
The RubyGem 'mev-sandwich-detect' version 0.9.1 is a malicious package that executes code at install time. It contains a stub gemspec with a native extension that does not build any addon but instead decodes and executes a hidden Ruby payload. This payload establishes a reverse shell to a hardcoded IP address, providing an interactive shell to an attacker. The payload includes anti-analysis checks to avoid execution in sandboxed or analyst environments and delays execution to evade detection. The package masquerades as a legitimate gem with misleading metadata.
The RubyGem 'crypto-tax-export' version 0.9.1 contains malicious code embedded in its native-extension build script. During installation, it performs sandbox evasion checks and, if it detects a real developer environment, it launches a delayed reverse shell to a hardcoded IP address. The gem's main code lacks legitimate functionality and appears to be a cover for the malicious payload.
The evm-tx-decoder RubyGem version 0.9.1 contains malicious code embedded in its native-extension build script extconf.rb. This script decodes and executes a base64-encoded Ruby payload that establishes a reverse shell connection to a hardcoded command-and-control server at 45.138.12.177:8089 during gem installation. The payload includes anti-analysis checks to evade detection in sandbox or analyst environments and delays execution before launching the backdoor shell. The package lacks legitimate functionality related to its stated purpose, indicating it is a malicious package designed to compromise the host at install time.
The wallet-balance-scanner RubyGem version 0.9.1 contains malicious code that executes a reverse shell during installation. The gem's native extension script is a payload that decodes and runs a base64-encoded backdoor, connecting to a hardcoded command-and-control server. The backdoor activates only on developer workstations, using heuristics to avoid sandbox and CI environments. The rest of the gem's code is a cover story with no legitimate wallet scanning functionality.
The RubyGem 'airdrop-eligibility-check' version 0.9.1 contains malicious code in its native extension build process. During installation, it decodes and executes a base64-encoded Ruby payload that, after a randomized delay, opens a reverse shell to a hardcoded IP address. The payload includes anti-analysis checks to avoid execution in CI environments, ephemeral hosts, or short uptime systems, and only activates if developer credential files are present. The gem itself has no legitimate functionality and serves solely as a vehicle for this malicious dropper.
The seed-phrase-validator RubyGem version 0.9.1 contains malicious code that executes during installation. It runs a base64-decoded Ruby payload in a detached process that opens a TCP socket to a hardcoded IP, providing a remote shell on the host. The malicious behavior is triggered only on developer environments with specific artifacts present, avoiding analysis environments. The package identity is inconsistent, indicating deception.
The RubyGem 'erc20-approve-audit' version 0.9.1 contains malicious code in its native extension script that executes automatically during installation. This code decodes and runs a Ruby payload that establishes a persistent reverse shell connection to a hardcoded IP address, allowing remote shell access to the host. The payload includes anti-analysis measures to avoid detection in CI environments, sandboxed hosts, and short uptime machines, and activates only when certain developer-related files are present. The gem's advertised identity does not match its actual contents, indicating deliberate deception.
The Ruby gem 'block-explorer-api' version 0.9.1 contains malicious code in its native-extension build script. This code decodes and executes a base64-encoded Ruby payload that establishes a reverse shell connection to a hardcoded command-and-control server. The payload activates only under specific conditions to evade detection, including anti-analysis checks and delays. The gem's advertised library is inert and does not match the gem's name or README, indicating deception.
The RubyGem package 'btc-fee-estimator' version 0.9.1 contains malicious code that executes a backdoor during installation. The gem's installation script decodes and evaluates a hidden Ruby payload that opens a TCP connection to a hardcoded IP address, providing remote shell access. The payload includes anti-analysis checks to avoid detection in CI environments, sandboxes, and machines without developer artifacts, targeting real developer workstations. The package itself has no legitimate functionality and serves solely as a cover for this install-time backdoor.
The RubyGem 'ton-jetton-tools' version 0.9.1 contains malicious code in its native-extension build script (extconf.rb). This code decodes and executes a payload during gem installation that establishes a reverse shell connection to a remote IP, allowing remote command execution on the installer's host. The payload includes anti-analysis checks to evade detection in CI or sandbox environments and only activates if certain developer artifacts are present. The gem's metadata is inconsistent with its README, indicating an attempt to disguise its malicious intent.
The RubyGem package hd-wallet-generator version 0.9.1 contains malicious code embedded in its native extension build script. During installation, it decodes and executes a payload that opens a remote TCP shell to a hardcoded IP address, allowing remote command execution on the installer's machine. The payload includes multiple evasion checks to avoid detection in sandbox or analysis environments. No legitimate native code is built; the extension build script is a decoy. The package metadata and README are inconsistent, indicating a disguised dropper.