supply chain event / NVI-00009591 / Revision 1
Malicious code in web3-eth-utils (RubyGems)
GitHub lists this malware advisory for web3-eth-utils, web3-eth-utils, web3-eth-utils. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.
This report has not inspected your inventory, configuration, deployed build, reachability or evidence. A catalog listing and a severity score do not establish exposure or compromise.
01 / Meaning
Why it matters
Published affected context helps an owner decide what evidence to gather. This report has not examined your application.
02 / Applicability
The affected context
Affected versions, configuration prerequisites and known exclusions are public. Confirm each one against the deployed service.
web3-eth-utils
source listed= 1.0.0
## Source: amazon-inspector (248aba9be7a8bfbd125b43640f1c52007358e34078b3bfec5430933c996b8666) The gem declares a native extension at ext/req_throttle_mini/extconf.rb but ships no C/C++/Rust sources, so the extension entry exists solely to force extconf.rb to run during `gem install`. Before calling mkmf/create_makefile, extconf.rb executes sandbox-evasion checks (CI env vars, generated usernames, hostname patterns, /tmp working directories, uptime under 30 minutes, absence of ~/.ssh, ~/.gitconfig, and ~/.gem/credentials) and only proceeds on hosts that look like real developer workstations. It then base64-decodes an opaque Ruby payload and, inside a double-forked detached child that sleeps for a randomized 20-40 minute delay, passes the decoded string to eval(). The decoded payload opens a TCP socket to 45.138.12.177:8089, spawns /bin/sh, and bridges the socket to the shell in a reconnect loop, yielding a persistent reverse shell under the installing user. The package name mimics the web3/eth ecosystem and lib/web3_eth_utils.rb is a trivial stub, consistent with a typosquat lure whose only functional effect is the install-time hook. --- Credit: [OpenSSF](https://github.com/ossf/
web3-eth-utils
source listed> 0
## Source: amazon-inspector (248aba9be7a8bfbd125b43640f1c52007358e34078b3bfec5430933c996b8666) The gem declares a native extension at ext/req_throttle_mini/extconf.rb but ships no C/C++/Rust sources, so the extension entry exists solely to force extconf.rb to run during `gem install`. Before calling mkmf/create_makefile, extconf.rb executes sandbox-evasion checks (CI env vars, generated usernames, hostname patterns, /tmp working directories, uptime under 30 minutes, absence of ~/.ssh, ~/.gitconfig, and ~/.gem/credentials) and only proceeds on hosts that look like real developer workstations. It then base64-decodes an opaque Ruby payload and, inside a double-forked detached child that sleeps for a randomized 20-40 minute delay, passes the decoded string to eval(). The decoded payload opens a TCP socket to 45.138.12.177:8089, spawns /bin/sh, and bridges the socket to the shell in a reconnect loop, yielding a persistent reverse shell under the installing user. The package name mimics the web3/eth ecosystem and lib/web3_eth_utils.rb is a trivial stub, consistent with a typosquat lure whose only functional effect is the install-time hook. --- Credit: [OpenSSF](https://github.com/ossf/
web3-eth-utils
source listed= 1.0.3
## Source: amazon-inspector (248aba9be7a8bfbd125b43640f1c52007358e34078b3bfec5430933c996b8666) The gem declares a native extension at ext/req_throttle_mini/extconf.rb but ships no C/C++/Rust sources, so the extension entry exists solely to force extconf.rb to run during `gem install`. Before calling mkmf/create_makefile, extconf.rb executes sandbox-evasion checks (CI env vars, generated usernames, hostname patterns, /tmp working directories, uptime under 30 minutes, absence of ~/.ssh, ~/.gitconfig, and ~/.gem/credentials) and only proceeds on hosts that look like real developer workstations. It then base64-decodes an opaque Ruby payload and, inside a double-forked detached child that sleeps for a randomized 20-40 minute delay, passes the decoded string to eval(). The decoded payload opens a TCP socket to 45.138.12.177:8089, spawns /bin/sh, and bridges the socket to the shell in a reconnect loop, yielding a persistent reverse shell under the installing user. The package name mimics the web3/eth ecosystem and lib/web3_eth_utils.rb is a trivial stub, consistent with a typosquat lure whose only functional effect is the install-time hook. --- Credit: [OpenSSF](https://github.com/ossf/
03 / Response
What to do next
- investigate
Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.
Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system. GitHub Advisory Database
A fixed release is not deployment evidence.
Check current vendor support and compatibility. After making a change, verify the deployed build and relevant runtime conditions. Keep the evidence, owner and time. An updated lockfile alone does not prove what is running.
04 / Limits
What this report cannot establish
- Customer inventory, deployment, reachability and exploitation have not been inspected.
05 / Provenance
Sources you can inspect
Each assertion retains its source. Mirrored records may repeat one underlying publisher; additional links are not independent corroboration.
- GHSA-847r-2824-c2jx ↗
GitHub Advisory Database · vendor advisory
Observed . GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.
Public revision history
Only published revisions appear here. Routine fetches do not create a material-change event.
- Revision 1 ·
First indexed by Null; source disclosure date is shown separately.