Source: amazon-inspector (e43c1d294111db5834d006f064d33001b463860783ed8662a5f41a8e7354e4b8)
The gem's native extension script, which runs automatically during gem install, base64-decodes a Ruby payload and launches it via a double-forked, detached, session-leader background process (setsid, /dev/null reopen, 20-40 minute delay). The decoded payload opens a TCP socket to the hardcoded bare IP 45.138.12.177:8089 and pipes a local /bin/sh to the socket in an infinite reconnect loop, giving a remote operator full shell control of the installer's host. Execution is gated by anti-analysis checks that suppress the payload inside CI providers (CI, GITHUB_ACTIONS, TRAVIS, JENKINS, GITLAB_CI, CODESPACES), ephemeral/sandbox hosts (uvm, firecracker, sandbox, vagrant), analyst-shaped usernames and working directories (/tmp, /var/tmp, /opt/rubygems, /workspace), and short machine uptimes (<1800s), firing only when developer-signal files are present (/.ssh, ~/.gitconfig, ~/.gem/credentials, ~/.bundle, ~/.npmrc). The gem's advertised identity does not match its shipped contents: the name is erc20-approve-audit but the README and the native makefile target are bitcoin-rpc-lite / bitcoin_rpc_lite_native, and the Ruby library surface is a two-method stub (build_id='ok', healthy?=true) with no functional code.
Credit: OpenSSF (source)
References
Source: amazon-inspector (e43c1d294111db5834d006f064d33001b463860783ed8662a5f41a8e7354e4b8)
The gem's native extension script, which runs automatically during
gem install, base64-decodes a Ruby payload and launches it via a double-forked, detached, session-leader background process (setsid, /dev/null reopen,20-40 minute delay). The decoded payload opens a TCP socket to the hardcoded bare IP 45.138.12.177:8089 and pipes a local /bin/sh to the socket in an infinite reconnect loop, giving a remote operator full shell control of the installer's host. Execution is gated by anti-analysis checks that suppress the payload inside CI providers (CI, GITHUB_ACTIONS, TRAVIS, JENKINS, GITLAB_CI, CODESPACES), ephemeral/sandbox hosts (uvm, firecracker, sandbox, vagrant), analyst-shaped usernames and working directories (/tmp, /var/tmp, /opt/rubygems, /workspace), and short machine uptimes (<1800s), firing only when developer-signal files are present (/.ssh, ~/.gitconfig, ~/.gem/credentials, ~/.bundle, ~/.npmrc). The gem's advertised identity does not match its shipped contents: the name iserc20-approve-auditbut the README and the native makefile target arebitcoin-rpc-lite/bitcoin_rpc_lite_native, and the Ruby library surface is a two-method stub (build_id='ok',healthy?=true) with no functional code.Credit: OpenSSF (source)
References