Malicious RubyGems package crypto-mnemonic-tools opens a remote shell on a developer's machine during installation
The gem presents itself as a dependency-free library for working with mnemonic phrases, but declares a native extension with no source code: its build script exists solely to execute code during gem install. The script decodes and executes a payload in a detached background process after a delay of tens of minutes, then connects to a hardcoded remote address and forwards an interactive shell there, giving an outsider unauthenticated access to the host. Execution is enabled only when developer artifacts are present on the machine, such as SSH keys, git configuration, gem and bundler credentials, and npm settings, and is suppressed when there are signs of a sandbox or CI. Neither the package name nor the README mentions a native extension, networking or background processes.
Immediately remove this gem and check project lock files and build logs for its presence. If it was installed, treat the host as compromised: isolate the machine, look for long-lived background processes and outgoing connections, and reissue SSH keys, gem/bundler/npm tokens and other credentials from this machine. If it held seed phrases or wallet keys, generate new secrets in an environment known to be clean and transfer funds to new addresses without waiting for signs of theft.
Source: github.com