MAL-2026-17785
Dashboard / Malicious Package / MAL-2026-17785
MAL-2026-17785
Summary: Malicious code in erc20-approve-audit (RubyGems)
Details: Source: amazon-inspector (e43c1d294111db5834d006f064d33001b463860783ed8662a5f41a8e7354e4b8) The gem's native extension script, which runs automatically during `gem install`, base64-decodes a Ruby payload and launches it via a double-forked, detached, session-leader background process (setsid, /dev/null reopen, ~20-40 minute delay). The decoded payload opens a TCP socket to the hardcoded bare IP 45.138.12.177:8089 and pipes a local /bin/sh to the socket in an infinite reconnect loop, giving a remote operator full shell control of the installer's host. Execution is gated by anti-analysis checks that suppress the payload inside CI providers (CI, GITHUB_ACTIONS, TRAVIS, JENKINS, GITLAB_CI, CODESPACES), ephemeral/sandbox hosts (uvm, firecracker, sandbox, vagrant), analyst-shaped usernames and working directories (/tmp, /var/tmp, /opt/rubygems, /workspace), and short machine uptimes (<1800s), firing only when developer-signal files are present (~/.ssh, ~/.gitconfig, ~/.gem/credentials, ~/.bundle, ~/.npmrc). The gem's advertised identity does not match its shipped contents: the name is `erc20-approve-audit` but the README and the native makefile target are `bitcoin-rpc-lite` / `bitcoin_rpc_lite_native`, and the Ruby library surface is a two-method stub (`build_id='ok'`, `healthy?=true`) with no functional code. Source: ossf-package-analysis (72bf8663ed3f4b92a50b3f9988ce63092fe827b55a65c726eee1f8f61163d890) The OpenSSF Package Analysis project identified 'erc20-approve-audit' @ 0.9.1 (rubygems) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.
Affected packages
Package
Name: erc20-approve-audit
Purl: pkg:gem/erc20-approve-audit
Affected ranges
Type: N/A
Events:
