MAL-2026-17785 Malicious code in erc20-approve-audit (RubyGems)

The gem's native extension script, which runs automatically during gem install, base64-decodes a Ruby payload and launches it via a double-forked, detached, session-leader background process (setsid, /dev/null reopen, 20-40 minute delay). The decoded payload opens a TCP socket to the hardcoded bare IP 45.138.12.177:8089 and pipes a local /bin/sh to the socket in an infinite reconnect loop, giving a remote operator full shell control of the installer's host. Execution is gated by anti-analysis checks that suppress the payload inside CI providers (CI, GITHUB_ACTIONS, TRAVIS, JENKINS, GITLAB_CI, CODESPACES), ephemeral/sandbox hosts (uvm, firecracker, sandbox, vagrant), analyst-shaped usernames and working directories (/tmp, /var/tmp, /opt/rubygems, /workspace), and short machine uptimes (<1800s), firing only when developer-signal files are present (/.ssh, ~/.gitconfig, ~/.gem/credentials, ~/.bundle, ~/.npmrc). The gem's advertised identity does not match its shipped contents: the name is erc20-approve-audit but the README and the native makefile target are bitcoin-rpc-lite / bitcoin_rpc_lite_native, and the Ruby library surface is a two-method stub (build_id='ok', healthy?=true) with no functional code.

The OpenSSF Package Analysis project identified 'erc20-approve-audit' @ 0.9.1 (rubygems) as malicious.

It is considered malicious because:

• The package executes one or more commands associated with malicious behavior.