MAL-2026-17799

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/wallet-balance-scanner/MAL-2026-17799.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17799
Published
2026-10-11T13:47:11Z
Modified
2026-10-11T14:30:09Z
Summary
Malicious code in wallet-balance-scanner (RubyGems)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (1506ac4eca059796d3f029e96fcfcafc24ffc6ad0b454ae831c06edef4064055)

The gem declares a native extension at ext/wallet_balance_scanner/extconf.rb but ships no C/C++/Rust sources; the extconf.rb is itself the payload rather than a build script, and runs automatically during gem install. The script decodes a base64 blob and launches it inside a detached, delayed forked process which opens a TCPSocket to the hardcoded bare-IP C2 45.138.12.177:8089 and pipes /bin/sh to it, handing a shell on the installer's host to the operator of that endpoint. Execution is gated by developer-workstation heuristics: it checks for ~/.ssh, ~/.gitconfig, ~/.npmrc, ~/.gem/credentials and ~/.bundle, requires host uptime over 1800 seconds, and bails out on CI, ephemeral hostnames, generated usernames, and known analysis/sandbox path prefixes, so the backdoor fires only on real developer machines. The lib/wallet_balance_scanner.rb entry and README (which refers to an unrelated bitcoin_rpc_lite library) are stubs with no relation to the declared wallet-scanning purpose, consistent with a cover-story gem whose only functional component is the install-time reverse shell.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-021358",
            "import_time": "2026-10-11T14:17:59.040838203Z",
            "modified_time": "2026-10-11T13:47:11Z",
            "sha256": "1506ac4eca059796d3f029e96fcfcafc24ffc6ad0b454ae831c06edef4064055",
            "source": "amazon-inspector",
            "versions": [
                "0.9.1"
            ]
        }
    ]
}
References
Credits

Affected packages

RubyGems / wallet-balance-scanner

Package

Name
wallet-balance-scanner
Purl
pkg:gem/wallet-balance-scanner

Affected ranges

Affected versions

0.*
0.9.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "ext/wallet_balance_scanner/extconf.rb",
            "sha256": "10218e975f54a4f11fe3954e1b584a5f05054003bf5773c3c2b8cceaa74ba763",
            "tlsh": "9751775acf8359e55aa1c0c045798012faa3ab0a50646875f3ee0868ff59b26c0f12fe"
        },
        {
            "path": "metadata.yaml",
            "sha256": "46bd020b2d4df50c6422c0b26bc5f5019d6a30071f13641373225622088e7b26",
            "tlsh": "8a2191506b83a57bf921d3da984423539367f708fd566911d7ebc14103990ae1bd7111"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/wallet-balance-scanner/MAL-2026-17799.json"