MAL-2026-17786

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/eth-gas-oracle/MAL-2026-17786.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17786
Published
2026-10-11T13:49:22Z
Modified
2026-10-11T14:30:06Z
Summary
Malicious code in eth-gas-oracle (RubyGems)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0f6cd8a676acbc17559b87ede98a030f26837472a482763f1e8a4818da65659d)

The gem's native extension build script ext/extconf.rb base64-decodes an embedded Ruby payload and executes it via eval inside a double-forked, detached child during gem install. The decoded payload opens a TCP connection to the hardcoded bare-IP host 45.138.12.177:8089 and bridges /bin/sh over the socket via IO.popen + IO.copy_stream, with a 30-second reconnect loop — a reverse-shell backdoor giving the remote operator arbitrary command execution on the installer's host. Execution is gated by sandbox/analysis-environment checks: the payload is skipped on CI env vars, ephemeral/sandbox hostnames, generated usernames matching uA\d+ or sandbox|tester|analys|scanner, analysis CWD prefixes (/opt/rubygems, /tmp, /workspace), and low machine uptime, and requires developer artifacts such as ~/.ssh, ~/.gitconfig, ~/.npmrc, or ~/.gem/credentials to be present. After daemonizing, the child sleeps 20–40 minutes before connecting, to evade install-time sandboxes. Package identity is inconsistent: metadata.yaml names the gem eth-gas-oracle, the README describes bitcoin-rpc-lite, extconf.rb calls create_makefile('bitcoin_rpc_lite_native'), and lib/eth_gas_oracle.rb is a two-method stub (VERSION, build_id, healthy?) with no real functionality, consistent with a disposable vehicle for the install-time dropper.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-021372",
            "import_time": "2026-10-11T14:18:00.17975389Z",
            "modified_time": "2026-10-11T13:49:22Z",
            "sha256": "0f6cd8a676acbc17559b87ede98a030f26837472a482763f1e8a4818da65659d",
            "source": "amazon-inspector",
            "versions": [
                "0.9.1"
            ]
        }
    ]
}
References
Credits

Affected packages

RubyGems / eth-gas-oracle

Package

Name
eth-gas-oracle
Purl
pkg:gem/eth-gas-oracle

Affected ranges

Affected versions

0.*
0.9.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "ext/eth_gas_oracle/extconf.rb",
            "sha256": "10218e975f54a4f11fe3954e1b584a5f05054003bf5773c3c2b8cceaa74ba763",
            "tlsh": "9751775acf8359e55aa1c0c045798012faa3ab0a50646875f3ee0868ff59b26c0f12fe"
        },
        {
            "path": "metadata.yaml",
            "sha256": "a44bdc31868f5e30ade4dd00a9ddb7c2fe8a91706a601f09ad16cad3391797f9",
            "tlsh": "0711ad81f5c6f47af009d3db58502303b363e60cbe676910aaa7c29a43895792747161"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/eth-gas-oracle/MAL-2026-17786.json"