If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (30e70156c49000f2a02130da13465705bea1e9663b3ba57246a4e264bb12db25)
The gem's native-extension build script (extconf.rb) contains a base64-encoded Ruby payload that is decoded and executed via eval during `gem install`. The decoded payload forks a detached, delayed child process that opens a TCP connection to 45.138.12.177:8089 and bridges the socket to /bin/sh, giving the operator of that endpoint an interactive shell on the installer's host. Execution is gated by anti-analysis checks that skip the payload when the environment looks like CI or a sandbox (CI env vars set, hostname matches sandbox/firecracker/vagrant patterns, auto-generated usernames, CWD under /tmp, /var/tmp, /opt/rubygems, or /workspace, machine uptime under 1800 seconds) and only fires when developer artefacts (~/.ssh, ~/.gitconfig, ~/.npmrc, ~/.gem/credentials, ~/.bundle) are present. The surrounding extconf.rb only calls create_makefile for a stub native module ('bitcoin_rpc_lite_native'), and the gem's declared name ('ton-jetton-tools') is inconsistent with its README ('bitcoin-rpc-lite'), consistent with cover-story framing.
Source: ossf-package-analysis (faf204a450ff3756811f85eb0dc1f394d43f945ba3cd37423cccb8e14c561fff)
The OpenSSF Package Analysis project identified 'ton-jetton-tools' @ 0.9.1 (rubygems) as malicious.
It is considered malicious because:
- The package executes one or more commands associated with malicious behavior.