RubyGems gem hd-wallet-generator contains a dropper: opens a remote shell on a developer's machine during installation
The package with the Bitcoin-oriented name hd-wallet-generator executes a Base64 payload through eval() in the native extension build script during gem installation itself. The payload connects to a hardcoded remote host and gives its operator an interactive /bin/sh; execution is delayed by 20–40 minutes, guarded by sandbox and CI checks, and triggers only where the disk shows signs of a developer workstation: SSH keys, git configuration, gem and bundle credentials, and npmrc. The package contains no native sources at all: building the extension is merely a pretext, and the name in the metadata differs from the README description. Anyone who installed this gem while looking for an HD wallet library should consider the host and all secrets stored on it accessible to outsiders.
Do not install this gem, and remove it from Gemfile and lock files immediately. If it has already been installed, treat the machine as compromised: disconnect it from the network, reissue SSH keys, git tokens, RubyGems and npm credentials, and replace seed phrases and private keys that were accessible on this host with new ones generated in a trusted, clean environment, then transfer funds to new addresses. Check the host's outgoing connections and cron/background processes over the past 24 hours.
Source: github.com