MAL-2026-17781
Dashboard / Malicious Package / MAL-2026-17781
MAL-2026-17781
Summary: Malicious code in btc-fee-estimator (RubyGems)
Details: Source: amazon-inspector (ad1e7bee3158f729d88fdaf6a35ebfd32dcdab26ee9de3d8362d1973774b4b7c) The gem's extconf.rb decodes a base64-encoded Ruby payload and evals it inside a detached forked process during `gem install`. The decoded payload opens a TCP connection to the hardcoded host 45.138.12.177 on port 8089 and bridges it to /bin/sh, providing interactive shell access on the installer's machine. Execution is gated by anti-analysis checks that skip CI environments, hostnames matching firecracker/sandbox/vagrant patterns, generated usernames, analysis paths such as /opt/rubygems and /tmp, machines with uptime under 1800 seconds, and hosts lacking developer artifacts (~/.ssh, ~/.gitconfig, ~/.gem/credentials, ~/.bundle) — targeting real developer workstations while remaining dormant in scanners. The gemspec and README describe unrelated functionality (a bitcoin fee estimator / bitcoin_rpc_lite helpers), and the shipped library exposes only stub methods (build_id, healthy?); the package has no legitimate functionality, serving solely as a cover for the install-time backdoor.
Affected packages
Package
Name: btc-fee-estimator
Purl: pkg:gem/btc-fee-estimator
Affected ranges
Type: N/A
Events:
