A supply-chain cluster of malicious RubyGems packages is delivering an interactive reverse shell at install time. The Open Source Malware archive added roughly two dozen crypto/web3 gems on 13 October — names including seed-phrase-validator, wallet-balance-scanner, xrp-ledger-utils, web3-signer-kit and hd-wallet-generator — while independent analysis by SafeDep counts 42 packages, from a single publisher account of 48, carrying the same malicious extension, and GitHub published advisory GHSA-vfwp-3q5f-qqrh for seed-phrase-validator. The mechanism is a declared native-extension build script (extconf.rb) that runs at gem install time: it decodes a Base64-encoded Ruby payload and executes it with eval() inside a detached fork, opening a socket to a hardcoded command-and-control endpoint and piping /bin/sh over it, with anti-sandbox checks for CI environments, hostnames, usernames and system uptime. The packages imitate seed-phrase and wallet tooling, which is what makes them dangerous to developers handling keys and recovery phrases. Audit recently installed gems in this naming space, rotate any credentials or seed material they touched, and pin verified versions.

• Source article