Source: amazon-inspector (0f6cd8a676acbc17559b87ede98a030f26837472a482763f1e8a4818da65659d)
The gem's native extension build script ext/extconf.rb base64-decodes an embedded Ruby payload and executes it via eval inside a double-forked, detached child during gem install. The decoded payload opens a TCP connection to the hardcoded bare-IP host 45.138.12.177:8089 and bridges /bin/sh over the socket via IO.popen + IO.copy_stream, with a 30-second reconnect loop — a reverse-shell backdoor giving the remote operator arbitrary command execution on the installer's host. Execution is gated by sandbox/analysis-environment checks: the payload is skipped on CI env vars, ephemeral/sandbox hostnames, generated usernames matching uA\d+ or sandbox|tester|analys|scanner, analysis CWD prefixes (/opt/rubygems, /tmp, /workspace), and low machine uptime, and requires developer artifacts such as ~/.ssh, ~/.gitconfig, ~/.npmrc, or ~/.gem/credentials to be present. After daemonizing, the child sleeps 20–40 minutes before connecting, to evade install-time sandboxes. Package identity is inconsistent: metadata.yaml names the gem eth-gas-oracle, the README describes bitcoin-rpc-lite, extconf.rb calls create_makefile('bitcoin_rpc_lite_native'), and lib/eth_gas_oracle.rb is a two-method stub (VERSION, build_id, healthy?) with no real functionality, consistent with a disposable vehicle for the install-time dropper.
Credit: OpenSSF (source)
References
Source: amazon-inspector (0f6cd8a676acbc17559b87ede98a030f26837472a482763f1e8a4818da65659d)
The gem's native extension build script ext/extconf.rb base64-decodes an embedded Ruby payload and executes it via eval inside a double-forked, detached child during
gem install. The decoded payload opens a TCP connection to the hardcoded bare-IP host 45.138.12.177:8089 and bridges /bin/sh over the socket via IO.popen + IO.copy_stream, with a 30-second reconnect loop — a reverse-shell backdoor giving the remote operator arbitrary command execution on the installer's host. Execution is gated by sandbox/analysis-environment checks: the payload is skipped on CI env vars, ephemeral/sandbox hostnames, generated usernames matchinguA\d+orsandbox|tester|analys|scanner, analysis CWD prefixes (/opt/rubygems,/tmp,/workspace), and low machine uptime, and requires developer artifacts such as~/.ssh,~/.gitconfig,~/.npmrc, or~/.gem/credentialsto be present. After daemonizing, the child sleeps 20–40 minutes before connecting, to evade install-time sandboxes. Package identity is inconsistent: metadata.yaml names the gemeth-gas-oracle, the README describesbitcoin-rpc-lite, extconf.rb callscreate_makefile('bitcoin_rpc_lite_native'), and lib/eth_gas_oracle.rb is a two-method stub (VERSION, build_id, healthy?) with no real functionality, consistent with a disposable vehicle for the install-time dropper.Credit: OpenSSF (source)
References