ton-jetton-tools

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (30e70156c49000f2a02130da13465705bea1e9663b3ba57246a4e264bb12db25)
The gem's native-extension build script (extconf.rb) contains a base64-encoded Ruby payload that is decoded and executed via eval during `gem install`. The decoded payload forks a detached, delayed child process that opens a TCP connection to 45.138.12.177:8089 and bridges the socket to /bin/sh, giving the operator of that endpoint an interactive shell on the installer's host. Execution is gated by anti-analysis checks that skip the payload when the environment looks like CI or a sandbox (CI env vars set, hostname matches sandbox/firecracker/vagrant patterns, auto-generated usernames, CWD under /tmp, /var/tmp, /opt/rubygems, or /workspace, machine uptime under 1800 seconds) and only fires when developer artefacts (~/.ssh, ~/.gitconfig, ~/.npmrc, ~/.gem/credentials, ~/.bundle) are present. The surrounding extconf.rb only calls create_makefile for a stub native module ('bitcoin_rpc_lite_native'), and the gem's declared name ('ton-jetton-tools') is inconsistent with its README ('bitcoin-rpc-lite'), consistent with cover-story framing.

Compromised versions (1)

• 0.9.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.