MAL-2026-17783 Malicious code in defi-yield-calculator (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee8b3e50479b61d2ff6e2f5a19de20473cf8fc3c91f99945aff51f112a617192 The gem ships an ext/extconf.rb that base64-decodes an embedded Ruby payload and runs it via eval inside a double-forked, detached, stdio-nulled...

Malicious code in erc20-approve-audit (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e43c1d294111db5834d006f064d33001b463860783ed8662a5f41a8e7354e4b8 The gem's native extension script, which runs automatically during gem install, base64-decodes a Ruby payload and launches it via a double-forked,...

MAL-2026-17785 Malicious code in erc20-approve-audit (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e43c1d294111db5834d006f064d33001b463860783ed8662a5f41a8e7354e4b8 The gem's native extension script, which runs automatically during gem install, base64-decodes a Ruby payload and launches it via a double-forked,...

MAL-2026-17794 Malicious code in seed-phrase-validator (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb8d12a066c24d672bf16efe57267c46c727592ee21beb0e2accb3bb6e4bfb3a The gem declares a native extension but ships no C/C++/Rust source. extconf.rb exists solely to execute at gem install time. It decodes a...

Malicious code in seed-phrase-validator (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb8d12a066c24d672bf16efe57267c46c727592ee21beb0e2accb3bb6e4bfb3a The gem declares a native extension but ships no C/C++/Rust source. extconf.rb exists solely to execute at gem install time. It decodes a...

Malicious code in evm-tx-decoder (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e478aa0270779720106fc6169e89fde089af352214fc720fbf8c284d51415f59 The gem's native-extension build script ext/extconf.rb decodes a base64-embedded Ruby payload and executes it via eval inside a double-forked, detach...

MAL-2026-17787 Malicious code in evm-tx-decoder (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e478aa0270779720106fc6169e89fde089af352214fc720fbf8c284d51415f59 The gem's native-extension build script ext/extconf.rb decodes a base64-embedded Ruby payload and executes it via eval inside a double-forked, detach...

MAL-2026-17798 Malicious code in tron-trc20-utils (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c840b18eadc331896e56720bc9a00f1239807542202bbd4ff9636737f27d0142 The gem's extconf.rb contains a base64-encoded Ruby payload that is decoded and eval'd inside a detached double-forked child during gem install. The...

Malicious code in tron-trc20-utils (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c840b18eadc331896e56720bc9a00f1239807542202bbd4ff9636737f27d0142 The gem's extconf.rb contains a base64-encoded Ruby payload that is decoded and eval'd inside a detached double-forked child during gem install. The...

MAL-2026-17789 Malicious code in hd-wallet-generator (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d6925082b6aa5db29d0569324b4485976add2368c78635d4be5c52270ee3771 The gem's declared native extension build script ext/hdwalletgenerator/extconf.rb executes a Base64-encoded payload via eval during gem install. The...

Malicious code in hd-wallet-generator (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d6925082b6aa5db29d0569324b4485976add2368c78635d4be5c52270ee3771 The gem's declared native extension build script ext/hdwalletgenerator/extconf.rb executes a Base64-encoded payload via eval during gem install. The...

Malicious code in ton-jetton-tools (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30e70156c49000f2a02130da13465705bea1e9663b3ba57246a4e264bb12db25 The gem's native-extension build script extconf.rb contains a base64-encoded Ruby payload that is decoded and executed via eval during gem install. T...

Malicious code in dex-router-abis (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8f8b62993678b4f720468a05ef91f6fdcc864dd6be78d1ffc6bd14125f18d8f The gem's extconf.rb executed automatically during gem install decodes a base64-encoded Ruby payload and executes it via a double-forked, detached...

Malicious code in wallet-hd-derive (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdfb31a6866dee961d55ad503da9de33a2cf743b52c80862e4380519ad5bef12 The gem is published as a crypto wallet utility but ships no native source; its gemspec declares extconf.rb as an extension so that gem install...

MAL-2026-17800 Malicious code in wallet-hd-derive (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdfb31a6866dee961d55ad503da9de33a2cf743b52c80862e4380519ad5bef12 The gem is published as a crypto wallet utility but ships no native source; its gemspec declares extconf.rb as an extension so that gem install...

MAL-2026-17793 Malicious code in perp-funding-rates (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 123418539e0264e9d58c8b51976723aff3eceec10520c231d7bc847edd51d691 The gem's native-extension script ext/perpfundingrates/extconf.rb contains no real build logic: it declares createmakefile'bitcoinrpclitenative' but...

MAL-2026-17802 Malicious code in xrp-ledger-utils (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d8cf595b60954811e6adfd0c4a241c696d326b42baf1ed2e7b163e720db44c4 The gem's native extension builder ext/extconf.rb decodes a base64-embedded Ruby payload and evals it inside a double-forked, detached child after a...

Malicious code in xrp-ledger-utils (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d8cf595b60954811e6adfd0c4a241c696d326b42baf1ed2e7b163e720db44c4 The gem's native extension builder ext/extconf.rb decodes a base64-embedded Ruby payload and evals it inside a double-forked, detached child after a...

rsync: Fix of 5 CVEs

CVE-2026-53790: refuse a shell-active RSYNCCONNECTPROG %H host and quote it; escape backtick, newline and carriage return in remote-shell arguments - CVE-2026-53793: confine a "/./" inner-module chroot: secure opens, changedir, chmod, rename, delta-basis opens and alt-dest basis stats, resolved...

UAC-0099 Targets Ukrainian Government Personnel With ASHVEIN RAT Hiding Commands in HTML

The Russia-aligned threat actor known as UAC-0099 has been attributed to a previously undocumented .NET infostealer and remote access trojan RAT codenamed ASHVEIN. According to TrendAI, the malware has been put to use in attacks targeting Ukrainian government personnel. The cybersecurity company ...