Description

The gem advertises itself as a BIP-39 mnemonic helper but ships an ext/req_throttle_mini/extconf.rb native-extension script with no C sources alongside it. On gem install, the extconf.rb decodes a base64 Ruby payload and evals it inside a detached, double-forked daemon that opens a TCPSocket to 45.138.12.177:8090 and bridges it to /bin/sh via IO.popen(['/bin/sh'], 'r+') and an IO.copy_stream loop, giving a remote operator interactive shell on the installer's host. Process.setsid, double fork, Process.detach, and reopening std streams to /dev/null background the shell so the install completes normally. Execution is gated by anti-analysis checks that skip CI environments (CI, GITHUB_ACTIONS, TRAVIS, JENKINS_URL, GITLAB_CI, CODESPACES), ephemeral/sandbox hostnames (uvm, firecracker, sandbox, vagrant), generated/analyst usernames, analysis working directories (/opt/rubygems, /tmp, /var/tmp, /workspace), and hosts with uptime under 1800 seconds, and additionally requires developer artifacts (~/.ssh, ~/.gitconfig, ~/.npmrc, ~/.gem/credentials, ~/.bundle) to be present before firing. The script then sleeps 1200+rand(1200) seconds before connecting to delay the egress past install-time monitoring. The extconf.rb calls create_makefile('crypto_mnemonic_tools_native') as a stub with no accompanying native source, so the extension exists solely as an install-time execution vector. The lure name targets developers handling crypto wallet mnemonics, whose workstations are the gated-for target.

The OpenSSF Package Analysis project identified 'crypto-mnemonic-tools' @ 1.0.0 (rubygems) as malicious.

It is considered malicious because:

The package executes one or more commands associated with malicious behavior.

Mitigation

Aliases

References