{"answers":{"affected":"1 open source package ship an affected version, including wallet-hd-derive.","exploited":"There is no known exploitation of MAL-2026-17800 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-17800 is a malicious package in wallet-hd-derive, published on 11 Oct 2026."},"fix_prompt":"MAL-2026-17800 is a malicious package: wallet-hd-derive (RubyGems). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-17800/ (Markdown: https://insights.sbomify.com/MAL-2026-17800/index.md)","id":"MAL-2026-17800","markdown":"https://insights.sbomify.com/MAL-2026-17800/index.md","name":"MAL-2026-17800","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The gem is published as a crypto wallet utility but ships no native source; its gemspec declares extconf.rb as an extension so that `gem install` auto-executes it. extconf.rb decodes a base64-encoded Ruby payload and, after checking for sandbox and analysis signals (CI env, ephemeral hostnames, generated usernames matching patterns such as `uA\\d+`/sandbox/tester/analys/scanner, cwd under /tmp, /opt/rubygems, /workspace, low machine uptime) and confirming developer-identifying files (`~/.ssh`, `~/.gem/credentials`, etc.), double-forks a detached process via fork + Process.setsid, sleeps for 20–40 minutes, then opens a TCP connection to 45.138.12.177:8089 and pipes /bin/sh in both directions using TCPSocket and IO.popen/IO.copy_stream. The shipped library at lib/wallet_hd_derive.rb exposes only two no-op methods (`build_id='ok'`, `healthy?=true`) and the README is branded for an unrelated package (`bitcoin-rpc-lite`), confirming the gem exists solely as a delivery vehicle for the install-time backdoor. The destination IP, base64 encoding of the payload, sandbox-evasion gating, and delayed reverse-shell establishment give a remote operator interactive /bin/sh on any developer or CI host that installs the gem.\n\nThe OpenSSF Package Analysis project identified 'wallet-hd-derive' @ 0.9.1 (rubygems) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.","ecosystems":["RubyGems"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in wallet-hd-derive (RubyGems)","id":"MAL-2026-17800","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"RubyGems","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"RubyGems","fixed":[],"introduced":[],"last_affected":[],"package":"wallet-hd-derive","purl":"pkg:gem/wallet-hd-derive","source":"MAL-2026-17800"}],"products":null,"published":"2026-10-11","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-17800/"}