mal-2026-17799

{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "ext/wallet_balance_scanner/extconf.rb",
              "sha256": "10218e975f54a4f11fe3954e1b584a5f05054003bf5773c3c2b8cceaa74ba763",
              "tlsh": "9751775acf8359e55aa1c0c045798012faa3ab0a50646875f3ee0868ff59b26c0f12fe"
            },
            {
              "path": "metadata.yaml",
              "sha256": "46bd020b2d4df50c6422c0b26bc5f5019d6a30071f13641373225622088e7b26",
              "tlsh": "8a2191506b83a57bf921d3da984423539367f708fd566911d7ebc14103990ae1bd7111"
            }
          ]
        },
        "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/wallet-balance-scanner/MAL-2026-17799.json"
      },
      "package": {
        "ecosystem": "RubyGems",
        "name": "wallet-balance-scanner",
        "purl": "pkg:gem/wallet-balance-scanner"
      },
      "versions": [
        "0.9.1"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    },
    {
      "contact": [
        "https://github.com/ossf/package-analysis",
        "https://openssf.slack.com/channels/package_analysis"
      ],
      "name": "OpenSSF: Package Analysis",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-021358",
        "import_time": "2026-10-11T14:17:59.040838203Z",
        "modified_time": "2026-10-11T13:47:11Z",
        "sha256": "1506ac4eca059796d3f029e96fcfcafc24ffc6ad0b454ae831c06edef4064055",
        "source": "amazon-inspector",
        "versions": [
          "0.9.1"
        ]
      },
      {
        "import_time": "2026-10-13T23:14:39.828156525Z",
        "modified_time": "2026-10-11T07:25:27Z",
        "sha256": "c307a3154873fc791254b5f8fd91803e64e5b49c8ec114a2eadcee895614ab42",
        "source": "ossf-package-analysis",
        "versions": [
          "0.9.1"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (1506ac4eca059796d3f029e96fcfcafc24ffc6ad0b454ae831c06edef4064055)\nThe gem declares a native extension at ext/wallet_balance_scanner/extconf.rb but ships no C/C++/Rust sources; the extconf.rb is itself the payload rather than a build script, and runs automatically during `gem install`. The script decodes a base64 blob and launches it inside a detached, delayed forked process which opens a TCPSocket to the hardcoded bare-IP C2 45.138.12.177:8089 and pipes /bin/sh to it, handing a shell on the installer's host to the operator of that endpoint. Execution is gated by developer-workstation heuristics: it checks for ~/.ssh, ~/.gitconfig, ~/.npmrc, ~/.gem/credentials and ~/.bundle, requires host uptime over 1800 seconds, and bails out on CI, ephemeral hostnames, generated usernames, and known analysis/sandbox path prefixes, so the backdoor fires only on real developer machines. The lib/wallet_balance_scanner.rb entry and README (which refers to an unrelated `bitcoin_rpc_lite` library) are stubs with no relation to the declared wallet-scanning purpose, consistent with a cover-story gem whose only functional component is the install-time reverse shell.\n\n## Source: ossf-package-analysis (c307a3154873fc791254b5f8fd91803e64e5b49c8ec114a2eadcee895614ab42)\nThe OpenSSF Package Analysis project identified 'wallet-balance-scanner' @ 0.9.1 (rubygems) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n",
  "id": "MAL-2026-17799",
  "modified": "2026-10-13T23:30:05.055132502Z",
  "published": "2026-10-11T07:25:27Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://rubygems.org/gems/wallet-balance-scanner/versions/0.9.1"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "Malicious code in wallet-balance-scanner (RubyGems)"
}