btc-fee-estimator

{"modified":"2026-10-11T13:46:21Z","published":"2026-10-11T13:46:21Z","schema_version":"1.7.4","id":"MAL-2026-17781","summary":"Malicious code in btc-fee-estimator (RubyGems)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ad1e7bee3158f729d88fdaf6a35ebfd32dcdab26ee9de3d8362d1973774b4b7c)\nThe gem's extconf.rb decodes a base64-encoded Ruby payload and evals it inside a detached forked process during `gem install`. The decoded payload opens a TCP connection to the hardcoded host 45.138.12.177 on port 8089 and bridges it to /bin/sh, providing interactive shell access on the installer's machine. Execution is gated by anti-analysis checks that skip CI environments, hostnames matching firecracker/sandbox/vagrant patterns, generated usernames, analysis paths such as /opt/rubygems and /tmp, machines with uptime under 1800 seconds, and hosts lacking developer artifacts (~/.ssh, ~/.gitconfig, ~/.gem/credentials, ~/.bundle) — targeting real developer workstations while remaining dormant in scanners. The gemspec and README describe unrelated functionality (a bitcoin fee estimator / bitcoin_rpc_lite helpers), and the shipped library exposes only stub methods (build_id, healthy?); the package has no legitimate functionality, serving solely as a cover for the install-time backdoor.\n","affected":[{"package":{"ecosystem":"RubyGems","name":"btc-fee-estimator"},"versions":["0.9.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"ext/btc_fee_estimator/extconf.rb","sha256":"10218e975f54a4f11fe3954e1b584a5f05054003bf5773c3c2b8cceaa74ba763","tlsh":"9751775acf8359e55aa1c0c045798012faa3ab0a50646875f3ee0868ff59b26c0f12fe"},{"path":"lib/btc_fee_estimator.rb","sha256":"1368d56f0552063ee6d15262e1d7e18fcdc184a66d401a48e01963a2bb1ec9ad","tlsh":"32d0972d422a2430887d70315cace9c7dfe88032839820b4a22c90c2170312e2337f70"}]}}}],"references":[{"type":"PACKAGE","url":"https://rubygems.org/gems/btc-fee-estimator/versions/0.9.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-021353","import_time":"2026-10-11T14:17:58.53327469Z","modified_time":"2026-10-11T13:46:21Z","sha256":"ad1e7bee3158f729d88fdaf6a35ebfd32dcdab26ee9de3d8362d1973774b4b7c","source":"amazon-inspector","versions":["0.9.1"]}]}}