Malicious tx-broadcast-utils gem poses as a Bitcoin transaction broadcasting library and runs a downloader during installation
A package named tx-broadcast-utils has been published on RubyGems, advertised as a set of helpers for broadcasting Bitcoin transactions through public esplora endpoints. It has none of the claimed functionality: the library contains only a shortened BIP39 word list, and its only working component is a native extension script that executes an encoded payload during `gem install`. The payload detaches a background process, waits several tens of minutes, then downloads and runs an external archive from a remote server as the installing user. Execution is deliberately suppressed in CI and sandboxes, and triggers only when there are signs of a developer workstation — SSH keys, git configuration and gem credentials.
Check right now whether this gem has been installed on development machines or in build environments, and exclude it from dependencies and mirrors. If it was installed, consider the host compromised: disconnect it from the network, look for an unfamiliar background process and temporary files, reissue SSH keys, RubyGems credentials and git tokens from another, clean machine, and replace any keys and seeds stored or used on this host and transfer funds to new addresses. Details are linked below.
Source: github.com