Malicious RubyGems gem bitciin: code runs during installation and can steal keys and publisher credentials
The gem, whose name differs from bitcoin by one character, declares a native extension solely to execute a build script during `gem install`; the C code itself is an empty stub, and the Ruby part contains only a static helper with a dictionary. The script checks that the machine looks like a developer workstation rather than a sandbox (CI variables, hostname and username, system uptime, the presence of SSH directories, git configuration, RubyGems credentials, bundler and npm), then backgrounds itself and decrypts a Ruby payload. The payload assembles the command-and-control server address from an encrypted blob, waits 20–40 minutes, downloads an archive to a temporary directory and runs a shell installer from there. The paths checked specifically include files containing package publishing tokens, indicating a second stage aimed at stealing credentials, including SSH keys and secrets stored alongside wallet and repository configurations.
Immediately check whether this gem has been installed on your machines or in CI, and do not install it in any form; if a dependency name contains a typo, correct it now. If it was installed, treat the machine as compromised: revoke and reissue RubyGems and npm tokens, SSH keys and git credentials, check background processes and temporary directories for unfamiliar archives and scripts, then reinstall the environment. Treat any seed phrases and private keys that were on this machine as exposed: generate new ones in a trusted environment and transfer funds to new addresses. Do not delay: the second stage targets secrets for theft.
Source: github.com