btc-fee-estimator

Details

**Severity:** Critical

**Affected versions:** `= 0.9.1`

## Source: amazon-inspector (ad1e7bee3158f729d88fdaf6a35ebfd32dcdab26ee9de3d8362d1973774b4b7c)
The gem's extconf.rb decodes a base64-encoded Ruby payload and evals it inside a detached forked process during `gem install`. The decoded payload opens a TCP connection to the hardcoded host 45.138.12.177 on port 8089 and bridges it to /bin/sh, providing interactive shell access on the installer's machine. Execution is gated by anti-analysis checks that skip CI environments, hostnames matching firecracker/sandbox/vagrant patterns, generated usernames, analysis paths such as /opt/rubygems and /tmp, machines with uptime under 1800 seconds, and hosts lacking developer artifacts (~/.ssh, ~/.gitconfig, ~/.gem/credentials, ~/.bundle) — targeting real developer workstations while remaining dormant in scanners. The gemspec and README describe unrelated functionality (a bitcoin fee estimator / bitcoin_rpc_lite helpers), and the shipped library exposes only stub methods (build_id, healthy?); the package has no legitimate functionality, serving solely as a cover for the install-time backdoor.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/ff41f6680a0ebbef2268cdb5daf253d4b400cb05/osv/malicious/rubygems/btc-fee-estimator/MAL-2026-17781.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/ff41f6680a0ebbef2268cdb5daf253d4b400cb05/osv/malicious/rubygems/btc-fee-estimator/MAL-2026-17781.json
- https://rubygems.org/gems/btc-fee-estimator/versions/0.9.1
- https://github.com/advisories/GHSA-4264-cr8p-9wh7

Compromised versions (1)

• = 0.9.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.