Malicious bitcion gem poses as a BIP-39 word list and downloads third-party code during installation
A RubyGems package with a name one letter different from that of a Bitcoin library contains an empty native stub whose sole purpose is to run the build script during installation. This script decrypts and executes a payload in a separate child process: it assembles the command server address, fetches an archive over plain HTTP into a temporary directory and runs a shell script from it — that is, arbitrary attacker code. The payload specifically looks for signs of a developer machine — ssh directories, git settings, gem and bundle credentials — and skips execution in sandboxes and CI, waiting for a random delay before downloading. Everything accessible through the keys and tokens on such a machine is at risk, including access to repositories and build infrastructure.
Check today whether this gem was installed in projects or on build machines — its name differs from the real library by one letter. If it was installed, consider the host compromised: disconnect it from the network, check temporary directories and background processes, reissue ssh keys, gem/bundle tokens and other secrets from this machine, recreate signing keys and wallets the machine had access to, and transfer funds to new addresses. Pin dependency installation with a lock file and prohibit execution of native extensions from unverified sources.
Source: github.com