Malicious nft-metadata-resolver gem poses as a bitcoin-rpc library and opens a reverse shell during installation
The package is published on RubyGems as nft-metadata-resolver, but its README describes it as the bitcoin-rpc-lite library, and the native extension build target is named accordingly, although the package contains no actual C/C++ code. The native extension script, which RubyGems runs automatically during `gem install`, decodes a base64 payload and launches it in a detached child process; the payload connects over TCP to a hardcoded IP address and forwards /bin/sh input and output there, giving the remote party an interactive shell on the machine performing the installation. Execution is guarded by anti-analysis checks: CI, sandboxes, “analysis” usernames and hosts with low uptime are skipped, and it triggers only when signs of a real developer machine are present. For anyone looking for a Ruby wrapper for Bitcoin Core RPC, this is a direct path to full control of the workstation, with all its keys, wallet files and access credentials.
Immediately check whether this gem was installed directly or as a dependency in projects or CI; if it was installed on a developer machine, treat the host as compromised: disconnect it from the network, do not entrust it with secrets, move development to a clean environment, change all keys, tokens and passwords that were on it, and transfer funds out of wallets whose keys or seed may have been there. Remove the package from Gemfile and lock files, and pin exact dependency names instead of similarly named ones.
Source: github.com