erc20-approve-audit

GHSA-mq54-cvw7-j5m5

Malicious code in erc20-approve-audit (RubyGems)

Details

**Severity:** Critical

**Affected versions:** `= 0.9.1`

## Source: amazon-inspector (e43c1d294111db5834d006f064d33001b463860783ed8662a5f41a8e7354e4b8)
The gem's native extension script, which runs automatically during `gem install`, base64-decodes a Ruby payload and launches it via a double-forked, detached, session-leader background process (setsid, /dev/null reopen, ~20-40 minute delay). The decoded payload opens a TCP socket to the hardcoded bare IP 45.138.12.177:8089 and pipes a local /bin/sh to the socket in an infinite reconnect loop, giving a remote operator full shell control of the installer's host. Execution is gated by anti-analysis checks that suppress the payload inside CI providers (CI, GITHUB_ACTIONS, TRAVIS, JENKINS, GITLAB_CI, CODESPACES), ephemeral/sandbox hosts (uvm, firecracker, sandbox, vagrant), analyst-shaped usernames and working directories (/tmp, /var/tmp, /opt/rubygems, /workspace), and short machine uptimes (<1800s), firing only when developer-signal files are present (~/.ssh, ~/.gitconfig, ~/.gem/credentials, ~/.bundle, ~/.npmrc). The gem's advertised identity does not match its shipped contents: the name is `erc20-approve-audit` but the README and the native makefile target are `bitcoin-rpc-lite` / `bitcoin_rpc_lite_native`, and the Ruby library surface is a two-method stub (`build_id='ok'`, `healthy?=true`) with no functional code.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/ff41f6680a0ebbef2268cdb5daf253d4b400cb05/osv/malicious/rubygems/erc20-approve-audit/MAL-2026-17785.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/ff41f6680a0ebbef2268cdb5daf253d4b400cb05/osv/malicious/rubygems/erc20-approve-audit/MAL-2026-17785.json
- https://rubygems.org/gems/erc20-approve-audit/versions/0.9.1
- https://github.com/advisories/GHSA-mq54-cvw7-j5m5

Compromised versions (1)

= 0.9.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.