{"id":"MAL-2026-17781","summary":"Malicious code in btc-fee-estimator (RubyGems)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ad1e7bee3158f729d88fdaf6a35ebfd32dcdab26ee9de3d8362d1973774b4b7c)\nThe gem's extconf.rb decodes a base64-encoded Ruby payload and evals it inside a detached forked process during `gem install`. The decoded payload opens a TCP connection to the hardcoded host 45.138.12.177 on port 8089 and bridges it to /bin/sh, providing interactive shell access on the installer's machine. Execution is gated by anti-analysis checks that skip CI environments, hostnames matching firecracker/sandbox/vagrant patterns, generated usernames, analysis paths such as /opt/rubygems and /tmp, machines with uptime under 1800 seconds, and hosts lacking developer artifacts (~/.ssh, ~/.gitconfig, ~/.gem/credentials, ~/.bundle) — targeting real developer workstations while remaining dormant in scanners. The gemspec and README describe unrelated functionality (a bitcoin fee estimator / bitcoin_rpc_lite helpers), and the shipped library exposes only stub methods (build_id, healthy?); the package has no legitimate functionality, serving solely as a cover for the install-time backdoor.\n","modified":"2026-10-11T14:30:06.032387531Z","published":"2026-10-11T13:46:21Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-10-11T14:17:58.53327469Z","modified_time":"2026-10-11T13:46:21Z","sha256":"ad1e7bee3158f729d88fdaf6a35ebfd32dcdab26ee9de3d8362d1973774b4b7c","source":"amazon-inspector","versions":["0.9.1"],"id":"IN-MAL-2026-021353"}]},"references":[{"type":"PACKAGE","url":"https://rubygems.org/gems/btc-fee-estimator/versions/0.9.1"}],"affected":[{"package":{"name":"btc-fee-estimator","ecosystem":"RubyGems","purl":"pkg:gem/btc-fee-estimator"},"versions":["0.9.1"],"database_specific":{"indicators":{"evidence_files":[{"sha256":"10218e975f54a4f11fe3954e1b584a5f05054003bf5773c3c2b8cceaa74ba763","tlsh":"9751775acf8359e55aa1c0c045798012faa3ab0a50646875f3ee0868ff59b26c0f12fe","path":"ext/btc_fee_estimator/extconf.rb"},{"tlsh":"32d0972d422a2430887d70315cace9c7dfe88032839820b4a22c90c2170312e2337f70","path":"lib/btc_fee_estimator.rb","sha256":"1368d56f0552063ee6d15262e1d7e18fcdc184a66d401a48e01963a2bb1ec9ad"}]},"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/btc-fee-estimator/MAL-2026-17781.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}