Malicious lightning-invoice-utils gem on RubyGems: dropper runs during installation
The package poses as a library for decoding BOLT11 invoices, but has none of the advertised functionality. The native extension executes automatically during gem install: the build script decodes the embedded payload, downloads an archive over unencrypted HTTP into a temporary directory and runs a shell script from it in a separate detached process. Execution is enabled only on machines with directories and files containing SSH keys and gem/npm/bundler credentials, and is suppressed in CI and sandboxes — the dropper specifically targets developer machines with access to keys and registries.
Check now whether this gem has been installed in your projects or build images; if it has, consider the machine compromised: remove the package, revoke and reissue SSH keys, RubyGems and npm tokens and other credentials stored on the host, and check temporary directories for traces of execution. Consider any seed phrases or wallet keys that were on this machine exposed, and transfer funds to new addresses with keys created in a clean environment. If you did not install it, add the package to the blocklist and check transitive dependencies.
Source: github.com