{"id":"MAL-2026-17786","summary":"Malicious code in eth-gas-oracle (RubyGems)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0f6cd8a676acbc17559b87ede98a030f26837472a482763f1e8a4818da65659d)\nThe gem's native extension build script ext/extconf.rb base64-decodes an embedded Ruby payload and executes it via eval inside a double-forked, detached child during `gem install`. The decoded payload opens a TCP connection to the hardcoded bare-IP host 45.138.12.177:8089 and bridges /bin/sh over the socket via IO.popen + IO.copy_stream, with a 30-second reconnect loop — a reverse-shell backdoor giving the remote operator arbitrary command execution on the installer's host. Execution is gated by sandbox/analysis-environment checks: the payload is skipped on CI env vars, ephemeral/sandbox hostnames, generated usernames matching `uA\\d+` or `sandbox|tester|analys|scanner`, analysis CWD prefixes (`/opt/rubygems`, `/tmp`, `/workspace`), and low machine uptime, and requires developer artifacts such as `~/.ssh`, `~/.gitconfig`, `~/.npmrc`, or `~/.gem/credentials` to be present. After daemonizing, the child sleeps 20–40 minutes before connecting, to evade install-time sandboxes. Package identity is inconsistent: metadata.yaml names the gem `eth-gas-oracle`, the README describes `bitcoin-rpc-lite`, extconf.rb calls `create_makefile('bitcoin_rpc_lite_native')`, and lib/eth_gas_oracle.rb is a two-method stub (VERSION, build_id, healthy?) with no real functionality, consistent with a disposable vehicle for the install-time dropper.\n","modified":"2026-10-11T14:30:06.082726035Z","published":"2026-10-11T13:49:22Z","database_specific":{"malicious-packages-origins":[{"versions":["0.9.1"],"id":"IN-MAL-2026-021372","import_time":"2026-10-11T14:18:00.17975389Z","modified_time":"2026-10-11T13:49:22Z","sha256":"0f6cd8a676acbc17559b87ede98a030f26837472a482763f1e8a4818da65659d","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://rubygems.org/gems/eth-gas-oracle/versions/0.9.1"}],"affected":[{"package":{"name":"eth-gas-oracle","ecosystem":"RubyGems","purl":"pkg:gem/eth-gas-oracle"},"versions":["0.9.1"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"sha256":"10218e975f54a4f11fe3954e1b584a5f05054003bf5773c3c2b8cceaa74ba763","tlsh":"9751775acf8359e55aa1c0c045798012faa3ab0a50646875f3ee0868ff59b26c0f12fe","path":"ext/eth_gas_oracle/extconf.rb"},{"path":"metadata.yaml","sha256":"a44bdc31868f5e30ade4dd00a9ddb7c2fe8a91706a601f09ad16cad3391797f9","tlsh":"0711ad81f5c6f47af009d3db58502303b363e60cbe676910aaa7c29a43895792747161"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/eth-gas-oracle/MAL-2026-17786.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}