The RubyGem 'mev-sandwich-detect' version 0.9.1 is a malicious package that executes code at install time. It contains a stub gemspec with a native extension that does not build any addon but instead decodes and executes a hidden Ruby payload. This payload establishes a reverse shell to a hardcoded IP address, providing an interactive shell to an attacker. The payload includes anti-analysis checks to avoid execution in sandboxed or analyst environments and delays execution to evade detection. The package masquerades as a legitimate gem with misleading metadata.
The RubyGem 'crypto-tax-export' version 0.9.1 contains malicious code embedded in its native-extension build script. During installation, it performs sandbox evasion checks and, if it detects a real developer environment, it launches a delayed reverse shell to a hardcoded IP address. The gem's main code lacks legitimate functionality and appears to be a cover for the malicious payload.
The RubyGem 'airdrop-eligibility-check' version 0.9.1 contains malicious code in its native extension build process. During installation, it decodes and executes a base64-encoded Ruby payload that, after a randomized delay, opens a reverse shell to a hardcoded IP address. The payload includes anti-analysis checks to avoid execution in CI environments, ephemeral hosts, or short uptime systems, and only activates if developer credential files are present. The gem itself has no legitimate functionality and serves solely as a vehicle for this malicious dropper.
The RubyGem package 'btc-fee-estimator' version 0.9.1 contains malicious code that executes a backdoor during installation. The gem's installation script decodes and evaluates a hidden Ruby payload that opens a TCP connection to a hardcoded IP address, providing remote shell access. The payload includes anti-analysis checks to avoid detection in CI environments, sandboxes, and machines without developer artifacts, targeting real developer workstations. The package itself has no legitimate functionality and serves solely as a cover for this install-time backdoor.
The RubyGem 'defi-yield-calculator' version 0.9.1 contains malicious code that executes a hidden payload during installation. This payload establishes a persistent remote shell connection to a hardcoded IP address, allowing an attacker interactive access to the victim's machine. The malicious behavior is concealed by anti-analysis checks to avoid detection in sandboxed or ephemeral environments. The package masquerades as a legitimate DeFi yield calculator but includes deceptive metadata and a native extension trigger solely to execute the malicious code.
The RubyGem 'staking-apr-fetcher' version 0.9.1 contains malicious code that executes a backdoor during installation. The gem's build script decodes and runs a hidden Ruby payload that creates a background process connecting to a remote host, providing interactive shell access to the attacker. The payload includes anti-analysis checks to avoid detection in CI environments, sandboxes, or analyst setups. The package has no legitimate functionality and is solely designed to deliver this install-time backdoor.
The RubyGem 'erc20-approve-audit' version 0.9.1 contains malicious code in its native extension script that executes automatically during installation. This code decodes and runs a Ruby payload that establishes a persistent reverse shell connection to a hardcoded IP address, allowing remote shell access to the host. The payload includes anti-analysis measures to avoid detection in CI environments, sandboxed hosts, and short uptime machines, and activates only when certain developer-related files are present. The gem's advertised identity does not match its actual contents, indicating deliberate deception.
The seed-phrase-validator RubyGem version 0.9.1 contains malicious code that executes during installation. It runs a base64-decoded Ruby payload in a detached process that opens a TCP socket to a hardcoded IP, providing a remote shell on the host. The malicious behavior is triggered only on developer environments with specific artifacts present, avoiding analysis environments. The package identity is inconsistent, indicating deception.
The evm-tx-decoder RubyGem version 0.9.1 contains malicious code embedded in its native-extension build script extconf.rb. This script decodes and executes a base64-encoded Ruby payload that establishes a reverse shell connection to a hardcoded command-and-control server at 45.138.12.177:8089 during gem installation. The payload includes anti-analysis checks to evade detection in sandbox or analyst environments and delays execution before launching the backdoor shell. The package lacks legitimate functionality related to its stated purpose, indicating it is a malicious package designed to compromise the host at install time.
The Ruby gem 'tron-trc20-utils' version 0.9.1 contains malicious code that executes a reverse shell during installation. The gem's extconf.rb file decodes and evaluates a base64-encoded payload that connects to a remote IP address and provides an interactive shell to the attacker. The malicious behavior is designed to evade sandbox and continuous integration environments by checking for specific environment variables, hostnames, usernames, working directories, system uptime, and the presence of developer artifacts. The gem's metadata and contents are inconsistent, indicating deception. This reverse shell is the primary functionality of the package, posing a significant security risk to users who install it.
The RubyGem package hd-wallet-generator version 0.9.1 contains malicious code embedded in its native extension build script. During installation, it decodes and executes a payload that opens a remote TCP shell to a hardcoded IP address, allowing remote command execution on the installer's machine. The payload includes multiple evasion checks to avoid detection in sandbox or analysis environments. No legitimate native code is built; the extension build script is a decoy. The package metadata and README are inconsistent, indicating a disguised dropper.
The RubyGem package nft-metadata-resolver version 0.9.1 contains a malicious native-extension script that executes a hidden payload during installation. This payload establishes a reverse shell connection to a hardcoded IP address, allowing remote code execution on the host. The malicious code includes sandbox evasion techniques to avoid detection in analysis environments. The package's metadata is inconsistent, misleading users about its true purpose.
The wallet-balance-scanner RubyGem version 0.9.1 contains malicious code that executes a reverse shell during installation. The gem's native extension script is a payload that decodes and runs a base64-encoded backdoor, connecting to a hardcoded command-and-control server. The backdoor activates only on developer workstations, using heuristics to avoid sandbox and CI environments. The rest of the gem's code is a cover story with no legitimate wallet scanning functionality.
The RubyGem 'ton-jetton-tools' version 0.9.1 contains malicious code in its native-extension build script (extconf.rb). This code decodes and executes a payload during gem installation that establishes a reverse shell connection to a remote IP, allowing remote command execution on the installer's host. The payload includes anti-analysis checks to evade detection in CI or sandbox environments and only activates if certain developer artifacts are present. The gem's metadata is inconsistent with its README, indicating an attempt to disguise its malicious intent.
The RubyGem package dex-router-abis version 0.9.1 contains malicious code in its extconf.rb script that executes automatically during installation. This script decodes and runs a base64-encoded Ruby payload which, after a delay, opens a reverse shell to a hardcoded remote host. The payload activates only on developer workstations with certain environment indicators and credentials present, allowing attackers interactive shell access with potential exposure of local SSH keys and publishing credentials.
The RubyGem 'wallet-hd-derive' version 0.9.1 contains malicious code that executes a backdoor during installation. The gemspec triggers execution of an encoded Ruby payload that performs sandbox evasion checks, then establishes a delayed reverse shell to a remote IP, allowing remote command execution on the host. The gem's library exposes only no-op methods and a misleading README, indicating it is solely a delivery vehicle for this backdoor.
The RubyGem 'perp-funding-rates' version 0.9.1 contains malicious code in its native-extension script that executes during installation. The script decodes and evaluates a hidden Ruby payload that establishes a reverse shell to a hardcoded command-and-control server, allowing remote code execution on the installer's machine. The payload activates only on developer workstations or build systems identified by the presence of specific user files, indicating a targeted attack. This behavior is obfuscated and delayed to evade detection.
The Ruby gem 'block-explorer-api' version 0.9.1 contains malicious code in its native-extension build script. This code decodes and executes a base64-encoded Ruby payload that establishes a reverse shell connection to a hardcoded command-and-control server. The payload activates only under specific conditions to evade detection, including anti-analysis checks and delays. The gem's advertised library is inert and does not match the gem's name or README, indicating deception.
The xrp-ledger-utils RubyGem version 0.9.1 contains malicious code embedded in its native extension builder. This code decodes and executes a base64-encoded Ruby payload that establishes a persistent remote shell connection to a hardcoded command-and-control server. The payload activates only on developer workstations, bypassing analysis environments, and provides an interactive shell to the attacker. The package itself has no legitimate functionality and is a malicious dropper disguised under unrelated project files.
The RubyGem 'gas-refuel-bridge' version 0.9.1 contains malicious code embedded in its native extension build script. During installation, it decodes and executes a hidden Ruby payload that establishes a persistent reverse shell to a remote server after a delay. The payload includes anti-analysis checks to avoid detection in CI environments or ephemeral systems and activates only on developer-like hosts. The gem's outward appearance is benign, with inert code and misleading documentation serving as a cover. This behavior poses a significant risk of unauthorized remote access on systems where the gem is installed.