MAL-2026-17786
Dashboard / Malicious Package / MAL-2026-17786
MAL-2026-17786
Summary: Malicious code in eth-gas-oracle (RubyGems)
Details: Source: amazon-inspector (0f6cd8a676acbc17559b87ede98a030f26837472a482763f1e8a4818da65659d) The gem's native extension build script ext/extconf.rb base64-decodes an embedded Ruby payload and executes it via eval inside a double-forked, detached child during `gem install`. The decoded payload opens a TCP connection to the hardcoded bare-IP host 45.138.12.177:8089 and bridges /bin/sh over the socket via IO.popen + IO.copy_stream, with a 30-second reconnect loop — a reverse-shell backdoor giving the remote operator arbitrary command execution on the installer's host. Execution is gated by sandbox/analysis-environment checks: the payload is skipped on CI env vars, ephemeral/sandbox hostnames, generated usernames matching `uA\d+` or `sandbox|tester|analys|scanner`, analysis CWD prefixes (`/opt/rubygems`, `/tmp`, `/workspace`), and low machine uptime, and requires developer artifacts such as `~/.ssh`, `~/.gitconfig`, `~/.npmrc`, or `~/.gem/credentials` to be present. After daemonizing, the child sleeps 20–40 minutes before connecting, to evade install-time sandboxes. Package identity is inconsistent: metadata.yaml names the gem `eth-gas-oracle`, the README describes `bitcoin-rpc-lite`, extconf.rb calls `create_makefile('bitcoin_rpc_lite_native')`, and lib/eth_gas_oracle.rb is a two-method stub (VERSION, build_id, healthy?) with no real functionality, consistent with a disposable vehicle for the install-time dropper.
Affected packages
Package
Name: eth-gas-oracle
Purl: pkg:gem/eth-gas-oracle
Affected ranges
Type: N/A
Events:
