Supply chain · rubygems · High

Malicious RubyGem 'staking-apr-fetcher' Delivers Interactive Shell Backdoor

Threat Engine Auto-Feed · data current as of 2026-10-11

The RubyGem 'staking-apr-fetcher' version 0.9.1 contains malicious code that establishes an interactive shell backdoor during installation. This package has no legitimate functionality and is designed solely to compromise the installer's machine, posing a critical supply-chain risk to Ruby development environments.

  • Package: rubygems / staking-apr-fetcher
  • Affected versions: = 0.9.1
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Credential / secret theft

The RubyGem 'staking-apr-fetcher' version 0.9.1 was found to contain malicious code. During the `gem install` process, its native extension build script executes a base64-encoded Ruby payload. This payload establishes a detached background process that connects to a hardcoded external IP address, providing interactive shell access to the attacker. The package's advertised functionality is a cover, as it provides no legitimate features.

How the attack works

This is a software supply-chain attack where a malicious package is disguised as a legitimate library. When installed, the package's build process covertly executes a payload. This payload establishes a persistent communication channel to an attacker-controlled server, granting remote interactive access to the compromised system. The attack includes anti-analysis checks to evade detection in common security and CI environments.

Who's exposed

Profiles most at risk

  • Organizations and development teams using RubyGems
  • Developers installing Ruby packages directly or via bundler
  • CI/CD pipelines that install Ruby dependencies, especially if not sandboxed or if anti-analysis checks are bypassed

Conditions that increase exposure

  • Unpinned dependencies that allow fetching the latest malicious version
  • Lack of lockfiles (e.g., `Gemfile.lock`) to ensure consistent dependency versions
  • Use of internal mirrors that may not vet packages for malicious content
  • Installation in environments that do not trigger the package's anti-analysis checks (e.g., developer workstations with long uptimes and developer-identifying files)

Blast-radius scenarios

  • An attacker gains interactive shell access to the machine where the gem was installed, potentially leading to data exfiltration, further lateral movement, or system compromise.
  • Sensitive credentials, source code, or other intellectual property on the compromised machine could be accessed and stolen.
  • The compromised machine could be used as a pivot point to attack other systems within the network.

What to do (defensive)

Detect

  • Scan RubyGems dependencies for known malicious packages, specifically 'staking-apr-fetcher' version 0.9.1.
  • Monitor network traffic for outbound connections to suspicious IP addresses, particularly 45.138.12.177:8089.
  • Implement file integrity monitoring for `extconf.rb` files in RubyGems installations.
  • Check for unexpected background processes or shell activity originating from Ruby environments.

Contain

  • Immediately isolate any systems found to have installed 'staking-apr-fetcher' version 0.9.1.
  • Block network traffic to and from the malicious IP address 45.138.12.177:8089 at the perimeter firewall.
  • Review and revoke any credentials that may have been present on compromised systems.

Remediate

  • Uninstall 'staking-apr-fetcher' version 0.9.1 from all affected systems.
  • Rebuild compromised systems from trusted images or known good backups.
  • Update `Gemfile.lock` files to pin all dependencies to known good versions.
  • Implement a robust software supply-chain security strategy, including dependency scanning and sandboxed build environments.

Frontier verdict — High

Prioritize immediate detection and removal of 'staking-apr-fetcher' version 0.9.1 due to critical interactive shell backdoor capabilities.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.