{"answers":{"affected":"1 open source package ship an affected version, including multichain-rpc.","exploited":"There is no known exploitation of MAL-2026-17791 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-17791 is a malicious package in multichain-rpc, published on 11 Oct 2026."},"fix_prompt":"MAL-2026-17791 is a malicious package: multichain-rpc (RubyGems). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-17791/ (Markdown: https://insights.sbomify.com/MAL-2026-17791/index.md)","id":"MAL-2026-17791","markdown":"https://insights.sbomify.com/MAL-2026-17791/index.md","name":"MAL-2026-17791","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The gem's extconf.rb, executed automatically by `gem install` as a native-extension build step, base64-decodes a Ruby payload and runs it via `eval` inside a double-forked, stdio-detached background process. The payload opens a TCP socket to the hardcoded host 45.138.12.177 on port 8089 and bridges it to `/bin/sh`, giving the remote operator an interactive shell on the installer's machine. Execution is gated by developer-host heuristics (presence of ~/.ssh, ~/.gitconfig, ~/.npmrc, ~/.gem/credentials, ~/.bundle, uptime \u003e 1800s) and explicit anti-analysis checks that skip CI, ephemeral, generated-user, and sandbox environments, with a 20-40 minute delay before firing. The rest of the gem is cover: lib/multichain_rpc.rb exports only stub methods (`build_id` returning 'ok', `healthy?` returning true), the README advertises an unrelated name (`bitcoin-rpc-lite`), and extconf.rb declares a native extension (`create_makefile('bitcoin_rpc_lite_native')`) but ships no C sources, so the file's sole purpose is to run the embedded payload. Installing the gem on a developer workstation yields a full-host remote shell to the attacker.","ecosystems":["RubyGems"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in multichain-rpc (RubyGems)","id":"MAL-2026-17791","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"RubyGems","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"RubyGems","fixed":[],"introduced":[],"last_affected":[],"package":"multichain-rpc","purl":"pkg:gem/multichain-rpc","source":"MAL-2026-17791"}],"products":null,"published":"2026-10-11","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-17791/"}