RubyGems gem wallet-balance-scanner found with a backdoor triggered during installation
The gem declares a native extension but contains no source code: instead of a build script, it contains the payload itself, which runs automatically during gem install. It decodes a base64 blob and starts a detached process that hands the host's shell to a hardcoded external server. Execution is deliberately restricted to signs of a real developer workstation: the presence of ssh directories, git and npm configurations, gem and bundler credentials, and system uptime; it aborts in CI and sandboxes. The claimed wallet balance scanning is a cover story: the main file and README (which refers to an unrelated library) are empty stubs.
Do not install this gem, and remove it from Gemfile and caches today. If it has already been installed on a workstation, treat the host as compromised: disconnect it from the network, revoke and reissue SSH keys, gem/npm tokens and other credentials stored there. If the machine held seed phrases or wallet keys, recreate them in a trusted, unaffected environment and transfer funds to new addresses.
Source: github.com