Threats Tagged 'mal-2026-17802'

The xrp-ledger-utils RubyGem version 0.9.1 contains malicious code embedded in its native extension builder. This code decodes and executes a base64-encoded Ruby payload that establishes a persistent remote shell connection to a hardcoded command-and-control server. The payload activates only on developer workstations, bypassing analysis environments, and provides an interactive shell to the attacker. The package itself has no legitimate functionality and is a malicious dropper disguised under unrelated project files.