Affected: RubyGems: web3-eth-utils

RubyGems runs this gem's native extension script `ext/req_throttle_mini/extconf.rb` during `gem install`. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30 minutes and the home directory holds `.ssh`, `.gitconfig`, `.npmrc`, `.gem/credentials` or `.bundle`. It then decodes a Base64 Ruby p…

Affected: RubyGems: wallet-crypto-utils

RubyGems runs this gem's native extension script `ext/req_throttle_mini/extconf.rb` during `gem install`. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30 minutes and the home directory holds `.ssh`, `.gitconfig`, `.npmrc`, `.gem/credentials` or `.bundle`. It then decodes a Base64 R…

Affected: RubyGems: eth-keystore-utils

RubyGems runs this gem's native extension script `ext/req_throttle_mini/extconf.rb` during `gem install`. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30 minutes and the home directory holds `.ssh`, `.gitconfig`, `.npmrc`, `.gem/credentials` or `.bundle`. It then decodes a Base64 Ru…

Affected: RubyGems: eth-address-utils

RubyGems runs this gem's native extension script `ext/req_throttle_mini/extconf.rb` during `gem install`. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30 minutes and the home directory holds `.ssh`, `.gitconfig`, `.npmrc`, `.gem/credentials` or `.bundle`. It then decodes a Base64 Rub…

Affected: RubyGems: crypto-mnemonic-tools

RubyGems runs this gem's native extension script `ext/req_throttle_mini/extconf.rb` during `gem install`. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30 minutes and the home directory holds `.ssh`, `.gitconfig`, `.npmrc`, `.gem/credentials` or `.bundle`. It then decodes a Base64…

Affected: RubyGems: btc-wallet-tools

RubyGems runs this gem's native extension script `ext/req_throttle_mini/extconf.rb` during `gem install`. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30 minutes and the home directory holds `.ssh`, `.gitconfig`, `.npmrc`, `.gem/credentials` or `.bundle`. It then decodes a Base64 Ruby…

Affected: RubyGems: bitcoin-rpc-lite

RubyGems runs this gem's native extension script `ext/req_throttle_mini/extconf.rb` during `gem install`. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30 minutes and the home directory holds `.ssh`, `.gitconfig`, `.npmrc`, `.gem/credentials` or `.bundle`. It then decodes a Base64 Ruby…

Affected: PyPI: media-manager5

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (b2598535fc7c58644f4dacb6b83f87a90823b8d1b84bc3357a6b2ae500342ba9) The package advertises itself as a 'silent per-user wallpaper rotator for Windows' but ships wallpaper.py, a command-and-control client that connects to the hardcoded endpoint https://googleforum.pythonanywhere.com. On construction of MediaManager5(), the package writes a…

Affected: PyPI: ig-gox

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (9b31f8ba5b2167be45b02cd3bbf840873adf76369e3ac472f1cccfc4a0579fff) The pypi package ig-gox ships a top-level ig_gox/__init__.py that, on import (the README's documented usage), base64-decodes a ~5 KB embedded blob, XOR-decrypts it with a hardcoded key, zlib-decompresses it, HMAC-verifies it, then exec/compiles the resulting Python under __name__=…

Affected: PyPI: agentaix

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (c403a9ecab78c519698c7faebcb0f9de4f8af059a4c3f5803acf8c534923138a) On `import agentaix`, `src/agentaix/__init__.py` executes `drop_readme_on_desktop()` at module top level, copying the bundled file `readme.txt` to `~/Desktop/readme.txt`. The file is not documentation: it is a Python remote-access client with a `#!/usr/bin/env python3` shebang that reg…