Malicious gem on RubyGems impersonates a bitcoin-rpc library and opens a remote shell during installation
A package has been found on RubyGems whose declared name suggests ERC20 auditing, but whose README and native build target present it as a lightweight library for accessing bitcoin RPC, while the Ruby code itself is an empty stub with two methods. The native extension script runs automatically when the gem is installed: it decodes a hidden payload and launches it as a detached background process with a delay, then connects to a hardcoded remote address and forwards the local shell there in an endless reconnection loop — giving full remote control over the developer's machine. The payload deliberately stays silent in CI, sandboxes and recently booted hosts, and triggers only where it sees signs of an active working environment: SSH keys, git configuration, RubyGems, bundle and npm credentials. Those who installed this gem on a machine used for building Bitcoin infrastructure or holding its keys are at risk.
Check gem installation history and project dependencies for this package today; if it was installed, consider the host compromised: disconnect it from the network, find and terminate the detached background shell process, reinstall the system, then change SSH keys, RubyGems and npm tokens, git credentials and any seeds/private keys that were stored or used on this machine, and transfer funds to addresses from a new seed created in a clean environment. Details are in the advisory linked below; there is no reason to wait — access is granted on the very first installation.
Source: github.com