Malicious seed-phrase-validator gem provides a remote shell on a developer's machine during installation
The seed-phrase-validator package published on RubyGems declares a native extension but contains no source code: its installation script exists solely to run during installation, decrypt a base64 payload and launch it in a detached process with a delayed start so it survives the installation process itself. The payload opens a TCP connection to a hardcoded address and connects it to a shell, giving the attacker interactive remote access to the host. Execution is filtered by anti-analysis checks: CI and sandboxes are skipped, and it triggers only on machines with developer artifacts such as SSH keys, git and npm configurations, and gem and bundle credentials. The package's identity is inconsistent: its name refers to seed phrase validation, its README is titled as a Bitcoin RPC library, the makefile target is the same, and there are no native sources; the package is therefore masquerading as Bitcoin tooling.
Immediately check whether this gem was installed directly or as a dependency in projects or on build machines; if it was, treat the host as compromised: disconnect it from the network, remove the package, reissue SSH keys, npm/gem/git tokens and other credentials from this machine, and check outgoing connections and background processes. If the machine held seed phrases or private keys, create new secrets in a trusted, unaffected environment and transfer funds. Add the package to a blocklist before someone on the team installs it because of a typo.
Source: github.com