eth-gas-oracle

Details

**Severity:** Critical

**Affected versions:** `= 0.9.1`

## Source: amazon-inspector (0f6cd8a676acbc17559b87ede98a030f26837472a482763f1e8a4818da65659d)
The gem's native extension build script ext/extconf.rb base64-decodes an embedded Ruby payload and executes it via eval inside a double-forked, detached child during `gem install`. The decoded payload opens a TCP connection to the hardcoded bare-IP host 45.138.12.177:8089 and bridges /bin/sh over the socket via IO.popen + IO.copy_stream, with a 30-second reconnect loop — a reverse-shell backdoor giving the remote operator arbitrary command execution on the installer's host. Execution is gated by sandbox/analysis-environment checks: the payload is skipped on CI env vars, ephemeral/sandbox hostnames, generated usernames matching `uA\d+` or `sandbox|tester|analys|scanner`, analysis CWD prefixes (`/opt/rubygems`, `/tmp`, `/workspace`), and low machine uptime, and requires developer artifacts such as `~/.ssh`, `~/.gitconfig`, `~/.npmrc`, or `~/.gem/credentials` to be present. After daemonizing, the child sleeps 20–40 minutes before connecting, to evade install-time sandboxes. Package identity is inconsistent: metadata.yaml names the gem `eth-gas-oracle`, the README describes `bitcoin-rpc-lite`, extconf.rb calls `create_makefile('bitcoin_rpc_lite_native')`, and lib/eth_gas_oracle.rb is a two-method stub (VERSION, build_id, healthy?) with no real functionality, consistent with a disposable vehicle for the install-time dropper.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/ff41f6680a0ebbef2268cdb5daf253d4b400cb05/osv/malicious/rubygems/eth-gas-oracle/MAL-2026-17786.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/ff41f6680a0ebbef2268cdb5daf253d4b400cb05/osv/malicious/rubygems/eth-gas-oracle/MAL-2026-17786.json
- https://rubygems.org/gems/eth-gas-oracle/versions/0.9.1
- https://github.com/advisories/GHSA-3h65-764h-38gg

Compromised versions (1)

• = 0.9.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.