Malicious code in coinmarket-utils (RubyGems)

Source: amazon-inspector 7ace1863ec858e5931ba2848276c14fb050fff204b2fbea82e2f64ae3f9a0ffc The gem's native extension build script ext/coinmarket-utils/extconf.rb contains a base64-encoded Ruby payload that is decoded and eval'd inside a double-forked, setsid, FD-detached child process at gem...

Malicious code in lightning-invoice-utils (RubyGems)

Source: amazon-inspector b1c7aa63129491dc29eaf240d8f4ae910733b8f6f34192279c119c3cb585c68d The gem declares a native extension extconf.rb that is auto-executed by gem install, but the shipped C stub InitLightningInvoiceUtils is empty — the native-extension slot is a cover. extconf.rb base64-decode...

Malicious code in etheremu.rb (RubyGems)

Source: amazon-inspector a82ac5d3f021ab23f4f461181f4150c12d672ef421b6f80c10dd8a307178442e The gem's extconf.rb, executed automatically during gem install, contains a base64-encoded Ruby payload that is decoded and eval'd inside a detached forked process. The payload XOR-decodes a hardcoded bare-I...

Malicious code in merkle-proof-lite (RubyGems)

Source: amazon-inspector 566447bbe57c81d3ad0e7f640951edd848b5a843c8b423ca370d96938d803cba The gem declares a native extension whose only real content is a 2-line empty Init stub in ext/merkle-proof-lite/merkle-proof-lite.c; no genuine native code is built. extconf.rb, which RubyGems executes duri...

Malicious code in crypti-toolbox (RubyGems)

Source: amazon-inspector 5ec4d5d5915335d90b2f18b45b050936fa5d2db9d176d7d081bd8c292c7c6795 On gem install, the native extension script ext/crypti-toolbox/extconf.rb runs an environment-fingerprinting routine that bails out on CI runners, ephemeral/sandbox hostnames, generated or analysis-shaped...

Malicious code in crypto-key-utils (RubyGems)

Source: amazon-inspector 559eb6e590366fcb8968de4964d8eb9d61ad6149a1ce1d4696ff4f64bff1a214 The gem declares a native extension whose extconf.rb is the attack vehicle: the C source ext/crypto-key-utils/crypto-key-utils.c is a two-line empty Init stub, and createmakefile is only reached after a bloc...

Malicious code in electrum-protocol-lite (RubyGems)

Source: amazon-inspector 668c7bcfd51cfcc2efda2d772dc087067883a214357361a960f6db8e2a9ca1e8 The gem's native-extension builder ext/.../extconf.rb is not a real build script: the shipped C source is a no-op stub, and extconf.rb instead decodes a base64-wrapped Ruby payload and evaluates it during ge...

Malicious code in tron-rb (RubyGems)

Source: amazon-inspector a483b2d8f8273b5dca3a95d449d762cdfe9d79e8aea485cb89673c469e4cda6f The gem advertises TRON protocol helpers but ships only a 45-byte empty C stub ext/tron-rb/tron-rb.c and a hardcoded word-list library module; its sole operative code path is in ext/tron-rb/extconf.rb. On ge...

Malicious Package

Overview personio-pipeline-projen is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview tiny-dom-focus-trap is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview css-txedrf-polyfill is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview css-gap-decorations-polyfill is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview css-reading-flow-polyfill is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in wallet-backup-tool (RubyGems)

Source: amazon-inspector 5452fd8e20feb6485c920b8c91f3d1f87c8bcd9f51ac9f4c57329ed9e2b20b37 The gem's native extension build script extconf.rb, which executes automatically on gem install, contains a base64-encoded Ruby payload that is eval'd inside a double-forked, detached, FD-redirected child...

Malicious Package

Overview ph-common is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview erc7730-hackathon is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview anthropic-sdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview lore-cs is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview zencleaner is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview solaan-ruby is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...