MAL-2026-17797 Malicious code in ton-jetton-tools (RubyGems)

The gem's native-extension build script (extconf.rb) contains a base64-encoded Ruby payload that is decoded and executed via eval during gem install. The decoded payload forks a detached, delayed child process that opens a TCP connection to 45.138.12.177:8089 and bridges the socket to /bin/sh, giving the operator of that endpoint an interactive shell on the installer's host. Execution is gated by anti-analysis checks that skip the payload when the environment looks like CI or a sandbox (CI env vars set, hostname matches sandbox/firecracker/vagrant patterns, auto-generated usernames, CWD under /tmp, /var/tmp, /opt/rubygems, or /workspace, machine uptime under 1800 seconds) and only fires when developer artefacts (~/.ssh, ~/.gitconfig, ~/.npmrc, ~/.gem/credentials, ~/.bundle) are present. The surrounding extconf.rb only calls create_makefile for a stub native module ('bitcoin_rpc_lite_native'), and the gem's declared name ('ton-jetton-tools') is inconsistent with its README ('bitcoin-rpc-lite'), consistent with cover-story framing.

The OpenSSF Package Analysis project identified 'ton-jetton-tools' @ 0.9.1 (rubygems) as malicious.

It is considered malicious because:

• The package executes one or more commands associated with malicious behavior.