MAL-2026-17786 Malicious code in eth-gas-oracle (RubyGems)

The gem's native extension build script ext/extconf.rb base64-decodes an embedded Ruby payload and executes it via eval inside a double-forked, detached child during gem install. The decoded payload opens a TCP connection to the hardcoded bare-IP host 45.138.12.177:8089 and bridges /bin/sh over the socket via IO.popen + IO.copy_stream, with a 30-second reconnect loop — a reverse-shell backdoor giving the remote operator arbitrary command execution on the installer's host. Execution is gated by sandbox/analysis-environment checks: the payload is skipped on CI env vars, ephemeral/sandbox hostnames, generated usernames matching uA\d+ or sandbox|tester|analys|scanner, analysis CWD prefixes (/opt/rubygems, /tmp, /workspace), and low machine uptime, and requires developer artifacts such as ~/.ssh, ~/.gitconfig, ~/.npmrc, or ~/.gem/credentials to be present. After daemonizing, the child sleeps 20–40 minutes before connecting, to evade install-time sandboxes. Package identity is inconsistent: metadata.yaml names the gem eth-gas-oracle, the README describes bitcoin-rpc-lite, extconf.rb calls create_makefile('bitcoin_rpc_lite_native'), and lib/eth_gas_oracle.rb is a two-method stub (VERSION, build_id, healthy?) with no real functionality, consistent with a disposable vehicle for the install-time dropper.