Malicious btc-wallet-tools package found on RubyGems, with a reverse shell during installation
The gem with a bitcoin-oriented name contains a base64 blob in its extension installation script, which is decoded and executed during normal package installation. The payload opens a TCP connection to the operator's server and links it to a shell, providing remote interactive access to the developer's machine. Execution is delayed by tens of minutes and disabled in CI, sandboxes and on hosts without signs of a developer's working environment — specifically targeting real workstations with SSH keys and git and gem credentials. The file has no useful functionality: its sole purpose is to execute opaque code.
Check right now whether this gem has been installed on workstations or build machines; at any sign of installation, treat the host as compromised: disconnect it from the network, revoke and rotate SSH keys, gem/npm tokens and other saved credentials. Replace wallet keys and seeds accessible from that machine, and move funds to new addresses from a trusted environment. Remove the package from dependencies and lockfiles, and check gem names for typos before installation. Details are linked in the post.
Source: github.com