ton-jetton-tools gem poses as a bitcoin-rpc library and can open a remote shell during installation
In the RubyGems package ton-jetton-tools, the native extension build script contains a base64-encoded payload that is decoded and executed during gem installation itself. The payload launches a delayed background process, connects to an external address and forwards /bin/sh there, giving the operator of that address an interactive shell on the developer's machine. Execution deliberately skips CI and sandboxes and triggers only where developer artifacts are found: SSH keys, git configuration, npm and RubyGems credentials, and bundler settings. The declared package name does not match its README and native module stub, which imitate a Bitcoin RPC access library, so developers of Bitcoin infrastructure appear to be the intended targets.
Immediately remove this gem from Gemfile, lock files and internal mirrors, and do not install it. Check installation history and build logs to see whether it was installed on workstations or servers. If it was installed, treat the host as compromised: disconnect it from the network, rotate SSH keys, RubyGems and npm tokens, passwords and API keys that were on it, and reinstall the system rather than cleaning it selectively. Treat any private keys and seeds stored or entered on this host as exposed: create new secrets in a trusted environment and transfer funds to new addresses without waiting for signs of theft.
Source: github.com