Description

The gem's native-extension build script extconf.rb, which runs automatically during gem install, contains a base64-encoded Ruby payload that is decoded and passed to eval inside a double-forked, detached child process. The decoded payload opens a TCP socket to the hardcoded attacker-controlled endpoint 45.138.12.177:8089 and bridges it to /bin/sh in a reconnect loop, giving the operator of that endpoint an interactive shell on the installing host. Execution is gated by evasion checks: the script refuses to run when environment variables or hostnames indicate CI (CI, GITHUB_ACTIONS, TRAVIS, JENKINS_URL, GITLAB_CI, CODESPACES; hostnames matching uvm/firecracker/sandbox/vagrant; usernames matching uA\d+/sandbox/tester/analys/scanner; cwd under /tmp, /opt/rubygems, /workspace; /proc/uptime under 1800 seconds) and fires only when developer-presence markers are found on disk (~/.ssh, ~/.gitconfig, ~/.npmrc, ~/.gem/credentials, ~/.bundle). The child additionally sleeps roughly 20-40 minutes before activating the shell, further hiding the behavior from short-lived analysis environments. Base64 encoding of the payload serves no functional purpose other than concealing the attacker IP, port, and /bin/sh bridge from casual source review.

The OpenSSF Package Analysis project identified 'bitcoin-rpc-lite' @ 1.0.0 (rubygems) as malicious.

It is considered malicious because:

The package executes one or more commands associated with malicious behavior.

Mitigation

Aliases

References