{"id":"MAL-2026-17799","summary":"Malicious code in wallet-balance-scanner (RubyGems)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1506ac4eca059796d3f029e96fcfcafc24ffc6ad0b454ae831c06edef4064055)\nThe gem declares a native extension at ext/wallet_balance_scanner/extconf.rb but ships no C/C++/Rust sources; the extconf.rb is itself the payload rather than a build script, and runs automatically during `gem install`. The script decodes a base64 blob and launches it inside a detached, delayed forked process which opens a TCPSocket to the hardcoded bare-IP C2 45.138.12.177:8089 and pipes /bin/sh to it, handing a shell on the installer's host to the operator of that endpoint. Execution is gated by developer-workstation heuristics: it checks for ~/.ssh, ~/.gitconfig, ~/.npmrc, ~/.gem/credentials and ~/.bundle, requires host uptime over 1800 seconds, and bails out on CI, ephemeral hostnames, generated usernames, and known analysis/sandbox path prefixes, so the backdoor fires only on real developer machines. The lib/wallet_balance_scanner.rb entry and README (which refers to an unrelated `bitcoin_rpc_lite` library) are stubs with no relation to the declared wallet-scanning purpose, consistent with a cover-story gem whose only functional component is the install-time reverse shell.\n\n## Source: ossf-package-analysis (c307a3154873fc791254b5f8fd91803e64e5b49c8ec114a2eadcee895614ab42)\nThe OpenSSF Package Analysis project identified 'wallet-balance-scanner' @ 0.9.1 (rubygems) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n","modified":"2026-10-13T23:30:05.057965513Z","published":"2026-10-11T07:25:27Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-021358","import_time":"2026-10-11T14:17:59.040838203Z","modified_time":"2026-10-11T13:47:11Z","sha256":"1506ac4eca059796d3f029e96fcfcafc24ffc6ad0b454ae831c06edef4064055","source":"amazon-inspector","versions":["0.9.1"]},{"source":"ossf-package-analysis","versions":["0.9.1"],"import_time":"2026-10-13T23:14:39.828156525Z","modified_time":"2026-10-11T07:25:27Z","sha256":"c307a3154873fc791254b5f8fd91803e64e5b49c8ec114a2eadcee895614ab42"}]},"references":[{"type":"PACKAGE","url":"https://rubygems.org/gems/wallet-balance-scanner/versions/0.9.1"}],"affected":[{"package":{"name":"wallet-balance-scanner","ecosystem":"RubyGems","purl":"pkg:gem/wallet-balance-scanner"},"versions":["0.9.1"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"path":"ext/wallet_balance_scanner/extconf.rb","sha256":"10218e975f54a4f11fe3954e1b584a5f05054003bf5773c3c2b8cceaa74ba763","tlsh":"9751775acf8359e55aa1c0c045798012faa3ab0a50646875f3ee0868ff59b26c0f12fe"},{"sha256":"46bd020b2d4df50c6422c0b26bc5f5019d6a30071f13641373225622088e7b26","tlsh":"8a2191506b83a57bf921d3da984423539367f708fd566911d7ebc14103990ae1bd7111","path":"metadata.yaml"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/wallet-balance-scanner/MAL-2026-17799.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}