Malicious Package

Overview css-a11y-contrast-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious Package

Overview rgx33-css-grid-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in coinmarket-utils (RubyGems)

Source: amazon-inspector 7ace1863ec858e5931ba2848276c14fb050fff204b2fbea82e2f64ae3f9a0ffc The gem's native extension build script ext/coinmarket-utils/extconf.rb contains a base64-encoded Ruby payload that is decoded and eval'd inside a double-forked, setsid, FD-detached child process at gem...

Malicious code in web3-eth-utils (RubyGems)

Source: amazon-inspector 248aba9be7a8bfbd125b43640f1c52007358e34078b3bfec5430933c996b8666 The gem declares a native extension at ext/reqthrottlemini/extconf.rb but ships no C/C++/Rust sources, so the extension entry exists solely to force extconf.rb to run during gem install. Before calling...

Malicious code in crypto-key-utils (RubyGems)

Source: amazon-inspector 559eb6e590366fcb8968de4964d8eb9d61ad6149a1ce1d4696ff4f64bff1a214 The gem declares a native extension whose extconf.rb is the attack vehicle: the C source ext/crypto-key-utils/crypto-key-utils.c is a two-line empty Init stub, and createmakefile is only reached after a bloc...

Malicious code in eth-keystore-utils (RubyGems)

Source: amazon-inspector cd660255e3a3483ed89e81f30c696390f8b182a891f8f1fb7e4c1cbb3b52eb32 The gem advertises itself as an Ethereum keystore helper but ships a native extension ext/reqthrottlemini/extconf.rb whose sole purpose is to execute a malicious payload during gem install. The extconf scrip...

Malicious code in tx-broadcast-utils (RubyGems)

Source: amazon-inspector 60efdf159c3ce8550c985b3f19cbe72f2bfcae0266cb63fb8c0dd458b56b9901 The gem's native-extension script ext/.../extconf.rb embeds a base64-encoded Ruby payload that is eval'd at gem install time. The payload double-forks and detaches a background process which sleeps 20-40...

Malicious code in blockchain-sync-utils (RubyGems)

Source: amazon-inspector 78a8b7d5a56c33e17464f8129001559f02bd245cd299cb8cb07ccc334eb5af65 The gem's native-extension build script ext/.../extconf.rb is a dropper rather than a real build step. The accompanying C source is a no-op stub, so the extension exists only to run install-time code. The...

Malicious code in utxo-set-utils (RubyGems)

Source: amazon-inspector 7dbd653d2b6e9dead4140f0538bb92092348b726319930b322d6c6346dd7b668 ext/utxo-set-utils/extconf.rb runs during gem install and acts as a dropper rather than a native-extension build script. The accompanying C source is an empty stub, so the extension exists solely to trigger...

Malicious code in lightning-invoice-utils (RubyGems)

Source: amazon-inspector b1c7aa63129491dc29eaf240d8f4ae910733b8f6f34192279c119c3cb585c68d The gem declares a native extension extconf.rb that is auto-executed by gem install, but the shipped C stub InitLightningInvoiceUtils is empty — the native-extension slot is a cover. extconf.rb base64-decode...

Malicious code in bip39-wordlist-utils (RubyGems)

Source: amazon-inspector 4b3ac427b6e4032e434211228b95b76c556690f86e9e3ba44134e2b8525253c5 The gem declares a native C extension whose shipped source ext/bip39-wordlist-utils/bip39-wordlist-utils.c is an empty Init stub, so gem install executes extconf.rb purely as a lifecycle hook. extconf.rb...

Malicious code in bitcoin-address-utils (RubyGems)

Source: amazon-inspector 8af579a1726db72e88f7c1755ebdec49a2d0a944d0e42a0fb36566d70d751e17 The gem's native-extension build script extconf.rb, which runs automatically during gem install, decodes a base64-wrapped Ruby payload that XOR-decodes a hardcoded URL approximately...

MAL-2026-17581 Malicious code in bip39-wordlist-utils (RubyGems)

RubyGems runs this gem's native extension script ext/bip39-wordlist-utils/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over ...

MAL-2026-17612 Malicious code in tx-broadcast-utils (RubyGems)

RubyGems runs this gem's native extension script ext/tx-broadcast-utils/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

Malicious code in tx-broadcast-utils (RubyGems)

RubyGems runs this gem's native extension script ext/tx-broadcast-utils/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

Malicious code in bip39-wordlist-utils (RubyGems)

RubyGems runs this gem's native extension script ext/bip39-wordlist-utils/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over ...

Malicious code in web3-eth-utils (RubyGems)

RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

MAL-2026-17616 Malicious code in web3-eth-utils (RubyGems)

RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

Malicious code in lightning-invoice-utils (RubyGems)

RubyGems runs this gem's native extension script ext/lightning-invoice-utils/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is ov...

MAL-2026-17608 Malicious code in lightning-invoice-utils (RubyGems)

RubyGems runs this gem's native extension script ext/lightning-invoice-utils/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is ov...