Malicious RubyGems gem poses as a bitcoin-rpc library and can open a reverse shell during installation
Malicious code has been found in the gas-refuel-bridge package for RubyGems: the native extension's build script decodes and executes an embedded payload during gem installation. The payload starts a detached background process that waits, connects to an external host and redirects /bin/sh to it — potentially giving an attacker persistent access to the developer's machine. Execution is deliberately skipped in CI and disposable environments, and occurs only if the disk contains signs of a working machine: SSH keys, git configurations, npm and RubyGems credentials, and bundler credentials. The advertised functionality is a cover: the description refers to a “gas refuel bridge,” the README is titled as a bitcoin-rpc library, and the library code itself consists of empty stubs, so the gem could be mistakenly added to a bitcoin project while searching for an RPC client.
Do not install this gem, and remove it from Gemfile and lockfiles right now. If it has already been installed on a working machine, treat the host as compromised: disconnect it from the network, check background processes and outbound connections, rotate SSH keys, RubyGems and npm tokens, and git credentials. Replace wallet secrets and seed phrases that were stored or entered on that machine, and move funds to new addresses from a trusted device. Details are linked below.
Source: github.com