The eth-gas-oracle RubyGem version 0.9.1 contains malicious code embedded in its native extension build script. During installation, it decodes and executes a hidden Ruby payload that establishes a reverse shell to a hardcoded IP address, allowing remote command execution on the installer's machine. The payload includes evasion techniques to avoid detection in sandbox or CI environments and requires the presence of developer artifacts to activate. The package metadata is inconsistent, indicating it is a disposable vehicle for malicious activity rather than legitimate functionality.
The multichain-rpc RubyGem version 0.9.1 contains malicious code embedded in its extconf.rb file. This code executes during gem installation, launching a background process that connects to a remote host and provides an interactive shell to an attacker. The payload uses evasion techniques to avoid detection in developer and CI environments and delays execution by 20-40 minutes. The gem's visible code is a decoy, with stub methods and misleading documentation.
The web3-signer-kit RubyGem version 0.9.1 contains malicious code embedded in its extconf.rb file. During gem installation, it decodes and executes a base64 payload that establishes a remote shell connection to a hardcoded IP address, enabling full remote code execution. The payload includes sandbox evasion techniques and requires the presence of developer artifacts before activating. The gem itself has no legitimate functionality and acts as a decoy to deliver this malicious payload.
The RubyGem 'mev-sandwich-detect' version 0.9.1 is a malicious package that executes code at install time. It contains a stub gemspec with a native extension that does not build any addon but instead decodes and executes a hidden Ruby payload. This payload establishes a reverse shell to a hardcoded IP address, providing an interactive shell to an attacker. The payload includes anti-analysis checks to avoid execution in sandboxed or analyst environments and delays execution to evade detection. The package masquerades as a legitimate gem with misleading metadata.
The RubyGem 'crypto-tax-export' version 0.9.1 contains malicious code embedded in its native-extension build script. During installation, it performs sandbox evasion checks and, if it detects a real developer environment, it launches a delayed reverse shell to a hardcoded IP address. The gem's main code lacks legitimate functionality and appears to be a cover for the malicious payload.
The RubyGem 'airdrop-eligibility-check' version 0.9.1 contains malicious code in its native extension build process. During installation, it decodes and executes a base64-encoded Ruby payload that, after a randomized delay, opens a reverse shell to a hardcoded IP address. The payload includes anti-analysis checks to avoid execution in CI environments, ephemeral hosts, or short uptime systems, and only activates if developer credential files are present. The gem itself has no legitimate functionality and serves solely as a vehicle for this malicious dropper.
The RubyGem package 'btc-fee-estimator' version 0.9.1 contains malicious code that executes a backdoor during installation. The gem's installation script decodes and evaluates a hidden Ruby payload that opens a TCP connection to a hardcoded IP address, providing remote shell access. The payload includes anti-analysis checks to avoid detection in CI environments, sandboxes, and machines without developer artifacts, targeting real developer workstations. The package itself has no legitimate functionality and serves solely as a cover for this install-time backdoor.
The RubyGem 'defi-yield-calculator' version 0.9.1 contains malicious code that executes a hidden payload during installation. This payload establishes a persistent remote shell connection to a hardcoded IP address, allowing an attacker interactive access to the victim's machine. The malicious behavior is concealed by anti-analysis checks to avoid detection in sandboxed or ephemeral environments. The package masquerades as a legitimate DeFi yield calculator but includes deceptive metadata and a native extension trigger solely to execute the malicious code.
The orderly-plugin-liquidity-heatmap npm package is a malicious supply-chain threat that activates only within GitHub Actions CI environments. It exports a non-functional stub but runs a postinstall script that collects sensitive CI runner metadata, enumerates environment variables related to GitHub Actions, captures the presence and length of the GITHUB_TOKEN, and abuses the workflow's OIDC token to access GitHub identity services. The collected data is written into the repository workspace, potentially allowing unauthorized commits and force-pushes using persisted credentials. This behavior effectively compromises the CI pipeline and can lead to full system compromise on machines where the package is installed.
The RubyGem 'staking-apr-fetcher' version 0.9.1 contains malicious code that executes a backdoor during installation. The gem's build script decodes and runs a hidden Ruby payload that creates a background process connecting to a remote host, providing interactive shell access to the attacker. The payload includes anti-analysis checks to avoid detection in CI environments, sandboxes, or analyst setups. The package has no legitimate functionality and is solely designed to deliver this install-time backdoor.
The RubyGem 'erc20-approve-audit' version 0.9.1 contains malicious code in its native extension script that executes automatically during installation. This code decodes and runs a Ruby payload that establishes a persistent reverse shell connection to a hardcoded IP address, allowing remote shell access to the host. The payload includes anti-analysis measures to avoid detection in CI environments, sandboxed hosts, and short uptime machines, and activates only when certain developer-related files are present. The gem's advertised identity does not match its actual contents, indicating deliberate deception.
The seed-phrase-validator RubyGem version 0.9.1 contains malicious code that executes during installation. It runs a base64-decoded Ruby payload in a detached process that opens a TCP socket to a hardcoded IP, providing a remote shell on the host. The malicious behavior is triggered only on developer environments with specific artifacts present, avoiding analysis environments. The package identity is inconsistent, indicating deception.
The evm-tx-decoder RubyGem version 0.9.1 contains malicious code embedded in its native-extension build script extconf.rb. This script decodes and executes a base64-encoded Ruby payload that establishes a reverse shell connection to a hardcoded command-and-control server at 45.138.12.177:8089 during gem installation. The payload includes anti-analysis checks to evade detection in sandbox or analyst environments and delays execution before launching the backdoor shell. The package lacks legitimate functionality related to its stated purpose, indicating it is a malicious package designed to compromise the host at install time.
The npm package 'react-dropzone-v4' version 99.0.0 is a malicious package that mimics the popular 'react-dropzone' library. It contains a preinstall script that executes automatically during installation, which performs DNS and HTTP requests to a third-party domain, transmitting the installer's hostname without consent. The package provides no legitimate functionality and appears designed for dependency confusion attacks to capture host information.
The Ruby gem 'tron-trc20-utils' version 0.9.1 contains malicious code that executes a reverse shell during installation. The gem's extconf.rb file decodes and evaluates a base64-encoded payload that connects to a remote IP address and provides an interactive shell to the attacker. The malicious behavior is designed to evade sandbox and continuous integration environments by checking for specific environment variables, hostnames, usernames, working directories, system uptime, and the presence of developer artifacts. The gem's metadata and contents are inconsistent, indicating deception. This reverse shell is the primary functionality of the package, posing a significant security risk to users who install it.
The RubyGem package hd-wallet-generator version 0.9.1 contains malicious code embedded in its native extension build script. During installation, it decodes and executes a payload that opens a remote TCP shell to a hardcoded IP address, allowing remote command execution on the installer's machine. The payload includes multiple evasion checks to avoid detection in sandbox or analysis environments. No legitimate native code is built; the extension build script is a decoy. The package metadata and README are inconsistent, indicating a disguised dropper.
The RubyGem package nft-metadata-resolver version 0.9.1 contains a malicious native-extension script that executes a hidden payload during installation. This payload establishes a reverse shell connection to a hardcoded IP address, allowing remote code execution on the host. The malicious code includes sandbox evasion techniques to avoid detection in analysis environments. The package's metadata is inconsistent, misleading users about its true purpose.
The wallet-balance-scanner RubyGem version 0.9.1 contains malicious code that executes a reverse shell during installation. The gem's native extension script is a payload that decodes and runs a base64-encoded backdoor, connecting to a hardcoded command-and-control server. The backdoor activates only on developer workstations, using heuristics to avoid sandbox and CI environments. The rest of the gem's code is a cover story with no legitimate wallet scanning functionality.
The RubyGem 'ton-jetton-tools' version 0.9.1 contains malicious code in its native-extension build script (extconf.rb). This code decodes and executes a payload during gem installation that establishes a reverse shell connection to a remote IP, allowing remote command execution on the installer's host. The payload includes anti-analysis checks to evade detection in CI or sandbox environments and only activates if certain developer artifacts are present. The gem's metadata is inconsistent with its README, indicating an attempt to disguise its malicious intent.
The RubyGem package dex-router-abis version 0.9.1 contains malicious code in its extconf.rb script that executes automatically during installation. This script decodes and runs a base64-encoded Ruby payload which, after a delay, opens a reverse shell to a hardcoded remote host. The payload activates only on developer workstations with certain environment indicators and credentials present, allowing attackers interactive shell access with potential exposure of local SSH keys and publishing credentials.