Malicious RubyGems package poses as the bitcoin-rpc-lite library and installs a reverse shell during installation
A gem has been published in the RubyGems registry whose metadata calls it eth-gas-oracle, but whose README and native extension name present it as a library for working with bitcoin-RPC — so the lure specifically targets Bitcoin developers. During `gem install`, the native extension build script decodes an embedded payload and launches it in a detached child process: it connects to a hardcoded remote host and hands over a shell, allowing the operator to execute arbitrary commands on the installer's machine. The payload deliberately evades analysis — it waits 20–40 minutes, skips CI and sandboxes, and runs only when developer artifacts such as SSH keys, git and npm configurations and gem credentials are present. The gem has no useful functionality: it is a disposable wrapper for a dropper.
Check now whether this gem has been installed on workstations or build machines, and do not pull it in as a dependency. If it was installed, consider the host compromised: disconnect it from the network, do not entrust it with secrets, rotate SSH keys, registry tokens and credentials stored in the home directory, and move funds out of any wallets whose keys or seeds may have been on this machine. Details are at the link in the post.
Source: github.com