Affected: RubyGems: web3-eth-utils

RubyGems runs this gem's native extension script `ext/req_throttle_mini/extconf.rb` during `gem install`. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30 minutes and the home directory holds `.ssh`, `.gitconfig`, `.npmrc`, `.gem/credentials` or `.bundle`. It then decodes a Base64 Ruby payload, forks twice into a detached process, waits 20 to 40 minutes and opens a reverse shell that connects `/bin/sh` to 45.138.12.177 on TCP port 8089. The shell reconnects every 30 seconds. The Ruby code in `lib/` is a decoy. The RubyGems account `reqthrottle_3474` published this gem and 41 others with the same loader on 2026-10-05.

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (248aba9be7a8bfbd125b43640f1c52007358e34078b3bfec5430933c996b8666) The gem declares a native extension at ext/req_throttle_mini/extconf.rb but ships no C/C++/Rust sources, so the extension entry exists solely to force extconf.rb to run during `gem install`. Before calling mkmf/create_makefile, extconf.rb executes sandbox-evasion checks (CI env vars, generated usernames, hostname patterns, /tmp working directories, uptime under 30 minutes, absence of ~/.ssh, ~/.gitconfig, and ~/.gem/credentials) and only proceeds on hosts that look like real developer workstations. It then base64-decodes an opaque Ruby payload and, inside a double-…

Affected: RubyGems: wallet-crypto-utils

RubyGems runs this gem's native extension script `ext/req_throttle_mini/extconf.rb` during `gem install`. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30 minutes and the home directory holds `.ssh`, `.gitconfig`, `.npmrc`, `.gem/credentials` or `.bundle`. It then decodes a Base64 Ruby payload, forks twice into a detached process, waits 20 to 40 minutes and opens a reverse shell that connects `/bin/sh` to 45.138.12.177 on TCP port 8089. The shell reconnects every 30 seconds. The Ruby code in `lib/` is a decoy. The RubyGems account `reqthrottle_3474` published this gem and 41 others with the same loader on 2026-10-05.

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (5d4c36227c90b4747bc37eb95200ddf64c2875dd153138bc496b39c1dda564f7) The gem declares a native extension (ext/req_throttle_mini/extconf.rb) that ships no C/C++/Rust sources; the extconf.rb only calls create_makefile('wallet_crypto_utils_native') after a hostile preamble. That preamble decodes a base64 blob and passes the result to eval inside a double-forked detached child. The decoded payload opens a TCP socket to the hardcoded bare IP 45.138.12.177 on port 8089, spawns /bin/sh via IO.popen, and bridges the shell's stdio over the socket with IO.copy_stream in a reconnect loop, yielding an interactive remote shell on the installer's…

Affected: RubyGems: eth-keystore-utils

RubyGems runs this gem's native extension script `ext/req_throttle_mini/extconf.rb` during `gem install`. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30 minutes and the home directory holds `.ssh`, `.gitconfig`, `.npmrc`, `.gem/credentials` or `.bundle`. It then decodes a Base64 Ruby payload, forks twice into a detached process, waits 20 to 40 minutes and opens a reverse shell that connects `/bin/sh` to 45.138.12.177 on TCP port 8090. The shell reconnects every 30 seconds. The Ruby code in `lib/` is a decoy. The RubyGems account `reqthrottle_3474` published this gem and 41 others with the same loader on 2026-10-05.

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (cd660255e3a3483ed89e81f30c696390f8b182a891f8f1fb7e4c1cbb3b52eb32) The gem advertises itself as an Ethereum keystore helper but ships a native extension (ext/req_throttle_mini/extconf.rb) whose sole purpose is to execute a malicious payload during `gem install`. The extconf script base64-decodes an embedded Ruby payload and `eval`s it inside a double-forked, detached child process, then writes an empty Makefile via create_makefile with no C sources present. The decoded payload opens a TCP connection to the hardcoded bare-IP C2 at 45.138.12.177:8090, pipes the socket to `/bin/sh` via IO.popen and IO.copy_stream in both directions,…

Affected: RubyGems: eth-address-utils

RubyGems runs this gem's native extension script `ext/req_throttle_mini/extconf.rb` during `gem install`. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30 minutes and the home directory holds `.ssh`, `.gitconfig`, `.npmrc`, `.gem/credentials` or `.bundle`. It then decodes a Base64 Ruby payload, forks twice into a detached process, waits 20 to 40 minutes and opens a reverse shell that connects `/bin/sh` to 45.138.12.177 on TCP port 8090. The shell reconnects every 30 seconds. The Ruby code in `lib/` is a decoy. The RubyGems account `reqthrottle_3474` published this gem and 41 others with the same loader on 2026-10-05.

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (8ed9d372d4fc694697be41c22e7c4d02d873e53e16bde2336069787b7b961ce2) The gem advertises itself as an Ethereum address utility library but its extconf.rb (auto-executed by `gem install`) carries a base64-encoded payload that is decoded and passed to `eval` inside a double-forked, detached background process. The decoded payload sleeps 20-40 minutes and then opens a TCPSocket to the hardcoded remote host 45.138.12.177 on port 8090, bridging the socket to `IO.popen(['/bin/sh'],'r+')` — a reverse shell giving the operator of that IP full remote code execution on the installer's host under the installing user's privileges. The extension…

Affected: RubyGems: crypto-mnemonic-tools

RubyGems runs this gem's native extension script `ext/req_throttle_mini/extconf.rb` during `gem install`. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30 minutes and the home directory holds `.ssh`, `.gitconfig`, `.npmrc`, `.gem/credentials` or `.bundle`. It then decodes a Base64 Ruby payload, forks twice into a detached process, waits 20 to 40 minutes and opens a reverse shell that connects `/bin/sh` to 45.138.12.177 on TCP port 8090. The shell reconnects every 30 seconds. The Ruby code in `lib/` is a decoy. The RubyGems account `reqthrottle_3474` published this gem and 41 others with the same loader on 2026-10-05.

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (44e296902c4b40fc0d6e6c2e431aa5e2a6e60002ddb1c6cb7619d3c4da5854f3) The gem advertises itself as a BIP-39 mnemonic helper but ships an `ext/req_throttle_mini/extconf.rb` native-extension script with no C sources alongside it. On `gem install`, the extconf.rb decodes a base64 Ruby payload and `eval`s it inside a detached, double-forked daemon that opens a TCPSocket to 45.138.12.177:8090 and bridges it to `/bin/sh` via `IO.popen(['/bin/sh'], 'r+')` and an `IO.copy_stream` loop, giving a remote operator interactive shell on the installer's host. Process.setsid, double fork, Process.detach, and reopening std streams to /dev/null backgr…

Affected: RubyGems: btc-wallet-tools

RubyGems runs this gem's native extension script `ext/req_throttle_mini/extconf.rb` during `gem install`. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30 minutes and the home directory holds `.ssh`, `.gitconfig`, `.npmrc`, `.gem/credentials` or `.bundle`. It then decodes a Base64 Ruby payload, forks twice into a detached process, waits 20 to 40 minutes and opens a reverse shell that connects `/bin/sh` to 45.138.12.177 on TCP port 8090. The shell reconnects every 30 seconds. The Ruby code in `lib/` is a decoy. The RubyGems account `reqthrottle_3474` published this gem and 41 others with the same loader on 2026-10-05.

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (06838084180f1f087704c390cedde5a8d3610f4895356632f938139faef7d5e3) extconf.rb in this gem decodes a base64-encoded Ruby payload with Base64.decode64 and executes it via eval() inside a double-forked, Process.setsid-detached child. The decoded payload opens a TCP socket to 45.138.12.177:8090 and bridges it to /bin/sh via IO.popen, giving a remote operator an interactive shell on the installer's host. Execution is gated by anti-analysis checks that skip CI environments, ephemeral/sandbox hostnames (firecracker, sandbox, vagrant), generated usernames (uA\d+, sandbox/tester/analys/scanner), analysis working directories (/opt/rubygems,…

Affected: RubyGems: bitcoin-rpc-lite

RubyGems runs this gem's native extension script `ext/req_throttle_mini/extconf.rb` during `gem install`. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30 minutes and the home directory holds `.ssh`, `.gitconfig`, `.npmrc`, `.gem/credentials` or `.bundle`. It then decodes a Base64 Ruby payload, forks twice into a detached process, waits 20 to 40 minutes and opens a reverse shell that connects `/bin/sh` to 45.138.12.177 on TCP port 8089. The shell reconnects every 30 seconds. The Ruby code in `lib/` is a decoy. The RubyGems account `reqthrottle_3474` published this gem and 41 others with the same loader on 2026-10-05.

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (c6a3f389c8d64d7aacbbd75f7a5c7b942e94445c03e822b57470bf9ee343f5cc) The gem's native-extension build script extconf.rb, which runs automatically during `gem install`, contains a base64-encoded Ruby payload that is decoded and passed to eval inside a double-forked, detached child process. The decoded payload opens a TCP socket to the hardcoded attacker-controlled endpoint 45.138.12.177:8089 and bridges it to /bin/sh in a reconnect loop, giving the operator of that endpoint an interactive shell on the installing host. Execution is gated by evasion checks: the script refuses to run when environment variables or hostnames indicate CI (…

Affected: PyPI: media-manager5

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (b2598535fc7c58644f4dacb6b83f87a90823b8d1b84bc3357a6b2ae500342ba9) The package advertises itself as a 'silent per-user wallpaper rotator for Windows' but ships wallpaper.py, a command-and-control client that connects to the hardcoded endpoint https://googleforum.pythonanywhere.com. On construction of MediaManager5(), the package writes a runner script to %LOCALAPPDATA%\MediaManager5\runner.py and registers a Windows Scheduled Task named 'MediaManager5' with /SC ONLOGON, so the agent is executed via pythonw at every user logon and re-invokes wallpaper.py on a 10-minute loop. The agent registers the host as username@hostname against /api/register and polls /api/client/<id>/poll for commands dispatched through a COMMAND_HANDLERS table that includes an 'exec' handler running arbitrary shell commands via subprocess.run(command, shell=True), plus list/upload/download/delete/rename handlers over arbitrary filesystem paths; handle_download base64-encodes file contents and returns them to the server via /api/client/<id>/result. The wallpaper framing in the package name, README, and docstrings does not match the shipped payload.

## Source: kam193 (28307627b9e2beadd142ce8e492f406f6ea13bad1ce2cf989b74e81954595e11) The package installs a persistent job that allows the attacker for exfiltrating files and executing remote code on the victim's machine.

---

Category: MALICIOUS - The campaign has clea…

Affected: PyPI: ig-gox

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (9b31f8ba5b2167be45b02cd3bbf840873adf76369e3ac472f1cccfc4a0579fff) The pypi package ig-gox ships a top-level ig_gox/__init__.py that, on import (the README's documented usage), base64-decodes a ~5 KB embedded blob, XOR-decrypts it with a hardcoded key, zlib-decompresses it, HMAC-verifies it, then exec/compiles the resulting Python under __name__='__main__'. The visible wrapper has no other functionality; all actual behavior of the package is contained in that concealed blob. Before decoding, the module performs anti-analysis checks: it calls sys.exit(0) if sys.gettrace() returns a tracer, if the process environment/cwd/argv contain substrings such as 'uncompyle', 'pycdc', 'decompyle', 'deobfuscate', 'hook', or 'frida', and it tampers with references to builtins.exec/eval/compile. The combination of a hidden exec-of-decoded-payload reached automatically on import and explicit evasions against debuggers and decompilers is deliberate concealment of code execution from the installer and from reviewers.

## Source: kam193 (780638a0747103eb44a85312a2cfb552981e498655f638c5baf86eb4a5f74042) Package hides obfuscated code aimed to avoid analysis and downloading the remote stage. The remote code is used to abuse Instagram service for mass fake account registration.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-ig-gox

Reasons (based…

Affected: PyPI: agentaix

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (c403a9ecab78c519698c7faebcb0f9de4f8af059a4c3f5803acf8c534923138a) On `import agentaix`, `src/agentaix/__init__.py` executes `drop_readme_on_desktop()` at module top level, copying the bundled file `readme.txt` to `~/Desktop/readme.txt`. The file is not documentation: it is a Python remote-access client with a `#!/usr/bin/env python3` shebang that registers `username@hostname` with a hardcoded command-and-control server at `https://googleforum.pythonanywhere.com` and polls `/api/client/<id>/...` for operator commands. Handlers implement arbitrary shell execution via `subprocess.run(command, shell=True)` (`handle_exec`), arbitrary file read with base64-encoded upload back to the C2 (`handle_download`), plus `upload`, `delete`, `rename`, and `open` operations. The dropper stages the payload under a benign filename in a highly visible location to induce the user to run it; once run, the operator obtains interactive shell and arbitrary file read on the host, enabling theft of SSH keys, cloud credentials, and other secrets. `pyproject.toml` ships placeholder author metadata (`Your Name` / `you@example.com`, `github.com/yourname/agentaix`), consistent with an unattributed malicious upload.

## Source: kam193 (fd321806b962224268527ea2f73221d5f6014beeca857682854fb5a5e85e5fb1) The package installs a persistent job that allows the attacker for exfiltrating files and executing remote code on the vi…