{"items":[{"id":"NVI-00009670","kind":"supply_chain_event","title":"Malicious code in bitcion-ruby (RubyGems)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-f4x2-825c-fcpf"],"plain_summary":"GitHub lists this malware advisory for bitcion-ruby. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-26cce16cff5ef09bf2adb24ff5095853"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-26cce16cff5ef09bf2adb24ff5095853","url":"https://github.com/advisories/GHSA-f4x2-825c-fcpf","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-f4x2-825c-fcpf","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T22:07:22.853Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-26cce16cff5ef09bf2adb24ff5095853"],"technology":"bitcion-ruby","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (27214f874c511d94a54d727b98ceb9feaec97d4b916794a9993c430cd215fc70)\nThe gem 'bitcion-ruby' is a one-edit typosquat of 'bitcoin-ruby'. The library has no real functionality (lib/ exposes only a hardcoded 48-word list; ext/bitcion-ruby/bitcion-ruby.c is an empty Init stub). The native extension's ext/bitcion-ruby/extconf.rb runs at `gem install` time and, before invoking create_makefile, base64-decodes and evals a Ruby payload. The payload performs sandbox/CI/analysis-environment fingerprinting (checks for ~/.ssh, ~/.gitconfig, ~/.gem/credentials, ~/.bundle, ~/.npmrc, requires uptime > 30 minutes, excludes CI environment variables and hostnames matching patterns like 'uvm', 'firecracker', 'sandbox', rejects generated-looking usernames and /tmp or /workspace working directories). On a real developer machine, it forks a detached child that sleeps 20-40 minutes, then curls a tarball to /tmp/.w1.tgz from a URL reconstructed by XOR-decoding a hardcoded hex string with the 4-byte key 'usv\\x9a' (overridable via the WG_KIT_URL env var), extracts it, and executes wg_install.sh via bash. The combination of typosquat identity, empty cover functionality, two-layer obfu","public_affected_ranges":["= 1.0.0"]}],"null_published_at":"2026-10-31T22:13:39.928Z","source_updated_at":"2026-10-06T03:31:21.000Z","source_disclosed_at":"2026-10-05T18:34:13.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T22:07:22.853Z"}],"next_cursor":null,"snapshot_revision":"42594"}