{"id":"MAL-2026-17799","summary":"Malicious code in wallet-balance-scanner (RubyGems)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1506ac4eca059796d3f029e96fcfcafc24ffc6ad0b454ae831c06edef4064055)\nThe gem declares a native extension at ext/wallet_balance_scanner/extconf.rb but ships no C/C++/Rust sources; the extconf.rb is itself the payload rather than a build script, and runs automatically during `gem install`. The script decodes a base64 blob and launches it inside a detached, delayed forked process which opens a TCPSocket to the hardcoded bare-IP C2 45.138.12.177:8089 and pipes /bin/sh to it, handing a shell on the installer's host to the operator of that endpoint. Execution is gated by developer-workstation heuristics: it checks for ~/.ssh, ~/.gitconfig, ~/.npmrc, ~/.gem/credentials and ~/.bundle, requires host uptime over 1800 seconds, and bails out on CI, ephemeral hostnames, generated usernames, and known analysis/sandbox path prefixes, so the backdoor fires only on real developer machines. The lib/wallet_balance_scanner.rb entry and README (which refers to an unrelated `bitcoin_rpc_lite` library) are stubs with no relation to the declared wallet-scanning purpose, consistent with a cover-story gem whose only functional component is the install-time reverse shell.\n","modified":"2026-10-11T14:30:09.664696640Z","published":"2026-10-11T13:47:11Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-10-11T14:17:59.040838203Z","modified_time":"2026-10-11T13:47:11Z","sha256":"1506ac4eca059796d3f029e96fcfcafc24ffc6ad0b454ae831c06edef4064055","source":"amazon-inspector","versions":["0.9.1"],"id":"IN-MAL-2026-021358"}]},"references":[{"type":"PACKAGE","url":"https://rubygems.org/gems/wallet-balance-scanner/versions/0.9.1"}],"affected":[{"package":{"name":"wallet-balance-scanner","ecosystem":"RubyGems","purl":"pkg:gem/wallet-balance-scanner"},"versions":["0.9.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"tlsh":"9751775acf8359e55aa1c0c045798012faa3ab0a50646875f3ee0868ff59b26c0f12fe","path":"ext/wallet_balance_scanner/extconf.rb","sha256":"10218e975f54a4f11fe3954e1b584a5f05054003bf5773c3c2b8cceaa74ba763"},{"sha256":"46bd020b2d4df50c6422c0b26bc5f5019d6a30071f13641373225622088e7b26","tlsh":"8a2191506b83a57bf921d3da984423539367f708fd566911d7ebc14103990ae1bd7111","path":"metadata.yaml"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/wallet-balance-scanner/MAL-2026-17799.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}