Malicious wallet-backup-tool gem on RubyGems runs a downloader during installation
The wallet-backup-tool package poses as a tool for working with BIP-39, but contains no real library: it provides a shortened word list instead of the full one, and the C extension is an empty stub. The native extension build script, which runs automatically during gem install, contains an encoded payload: it runs in a hidden child process after first checking that the machine does not look like CI or a sandbox and that the home directory contains developer files (ssh keys, git configuration, gem and bundler credentials). Then, after a random delay, the payload downloads an archive over unencrypted HTTP and executes a script from it. It specifically targets developer machines where crypto wallets and secrets sit alongside development keys.
Check now whether this gem has been installed directly or as a dependency in projects and CI; if found, remove it immediately and consider the machine compromised: revoke and regenerate ssh keys, RubyGems and bundler tokens and other secrets stored there. If seeds or private keys were on this machine, create a new seed in an environment known to be clean and transfer funds without waiting for confirmation — the description does not establish exactly what the downloaded script did.
Source: github.com