{"affected":[{"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"ext/wallet_balance_scanner/extconf.rb","sha256":"10218e975f54a4f11fe3954e1b584a5f05054003bf5773c3c2b8cceaa74ba763","tlsh":"9751775acf8359e55aa1c0c045798012faa3ab0a50646875f3ee0868ff59b26c0f12fe"},{"path":"metadata.yaml","sha256":"46bd020b2d4df50c6422c0b26bc5f5019d6a30071f13641373225622088e7b26","tlsh":"8a2191506b83a57bf921d3da984423539367f708fd566911d7ebc14103990ae1bd7111"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/wallet-balance-scanner/MAL-2026-17799.json"},"package":{"ecosystem":"RubyGems","name":"wallet-balance-scanner","purl":"pkg:gem/wallet-balance-scanner"},"versions":["0.9.1"]}],"credits":[{"contact":["inspector-research@amazon.com"],"name":"Amazon Inspector","type":"FINDER"},{"contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"name":"OpenSSF: Package Analysis","type":"FINDER"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-021358","import_time":"2026-10-11T14:17:59.040838203Z","modified_time":"2026-10-11T13:47:11Z","sha256":"1506ac4eca059796d3f029e96fcfcafc24ffc6ad0b454ae831c06edef4064055","source":"amazon-inspector","versions":["0.9.1"]},{"import_time":"2026-10-13T23:14:39.828156525Z","modified_time":"2026-10-11T07:25:27Z","sha256":"c307a3154873fc791254b5f8fd91803e64e5b49c8ec114a2eadcee895614ab42","source":"ossf-package-analysis","versions":["0.9.1"]}]},"details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1506ac4eca059796d3f029e96fcfcafc24ffc6ad0b454ae831c06edef4064055)\nThe gem declares a native extension at ext/wallet_balance_scanner/extconf.rb but ships no C/C++/Rust sources; the extconf.rb is itself the payload rather than a build script, and runs automatically during `gem install`. The script decodes a base64 blob and launches it inside a detached, delayed forked process which opens a TCPSocket to the hardcoded bare-IP C2 45.138.12.177:8089 and pipes /bin/sh to it, handing a shell on the installer's host to the operator of that endpoint. Execution is gated by developer-workstation heuristics: it checks for ~/.ssh, ~/.gitconfig, ~/.npmrc, ~/.gem/credentials and ~/.bundle, requires host uptime over 1800 seconds, and bails out on CI, ephemeral hostnames, generated usernames, and known analysis/sandbox path prefixes, so the backdoor fires only on real developer machines. The lib/wallet_balance_scanner.rb entry and README (which refers to an unrelated `bitcoin_rpc_lite` library) are stubs with no relation to the declared wallet-scanning purpose, consistent with a cover-story gem whose only functional component is the install-time reverse shell.\n\n## Source: ossf-package-analysis (c307a3154873fc791254b5f8fd91803e64e5b49c8ec114a2eadcee895614ab42)\nThe OpenSSF Package Analysis project identified 'wallet-balance-scanner' @ 0.9.1 (rubygems) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n","id":"MAL-2026-17799","modified":"2026-10-13T23:30:05.055132502Z","published":"2026-10-11T07:25:27Z","references":[{"type":"PACKAGE","url":"https://rubygems.org/gems/wallet-balance-scanner/versions/0.9.1"}],"schema_version":"1.9.0","summary":"Malicious code in wallet-balance-scanner (RubyGems)"}