Malicious bip39-wordlist-utils gem executes a hidden downloader during installation
A package with a Bitcoin-related name (BIP39) has been published on RubyGems but contains no real native code: the build script decrypts a base64 blob and executes it during `gem install` itself. The payload downloads an archive from a hardcoded IP over plain HTTP, extracts it into a temporary directory and runs a script as the installing user, making the installation appear successful. The downloader deliberately avoids sandboxes and CI, triggers only when it finds signs of a developer workstation (SSH keys, git configuration, gem/bundle/npm credentials), and waits before running — meaning it targets machines where secrets are stored and Bitcoin code may be built.
Check right now whether this gem has been installed on workstations or in build environments; if there is any trace of installation, consider the host compromised — isolate it, remove the package and rotate all secrets stored there (SSH keys, git tokens, RubyGems/npm credentials). If wallet files or seeds were on the machine, transfer funds to a wallet created in an environment known to be clean without delay. Block the package name in internal mirrors and check the names of BIP39 libraries before installing them in future.
Source: github.com