The Open Source Malware (OSM) watch archive marked a coordinated cluster of roughly two dozen RubyGems packages (including wallet-balance-scanner, xrp-ledger-utils, web3-signer-kit, hd-wallet-generator and seed-phrase-validator) as 🆕 added to the local archive on 13 October, all rated critical. Analysis of representative gempackages found a declared native-extension build script (extconf.rb) that decodes and eval()s a Base64 payload — opening a TCP socket to a hardcoded remote host (45.138.12.177:8089) and piping /bin/sh over it for an interactive reverse shell, with heavy anti-sandbox evasion (CI checks, hostname/username filters, uptime and developer-signature paths). The packages present crypto/web3 seed-generation and wallet tooling, making them attractive to developers handling keys and recovery phrases. This is the latest echo of a persistent trend of blockchain-adjacent supply-chain malware. Users should audit any recently installed RubyGem in this naming space, rotate any credentials/seed material touched by affected tooling, and rely on verified package versions.

• Source article