Supply chain · rubygems · High

Malicious RubyGem 'xrp-ledger-utils' Delivers Remote Shell via Install-Time Dropper

Threat Engine Auto-Feed · data current as of 2026-10-11

The RubyGem package 'xrp-ledger-utils' version 0.9.1 contains malicious code that establishes a remote shell on the host system during installation. This package has no legitimate functionality and is designed solely to deliver an interactive shell, posing a critical supply-chain risk for RubyGems users.

  • Package: rubygems / xrp-ledger-utils
  • Affected versions: = 0.9.1
  • Severity: critical
  • Reach: unknown
  • Exposure: 65/100 (High)

What happened — Credential / secret theft

The 'xrp-ledger-utils' RubyGem, specifically version 0.9.1, was found to contain malicious code. During its installation, a native extension builder executes a base64-encoded Ruby payload. This payload establishes a persistent remote shell connection to a hardcoded command-and-control server, providing an attacker with interactive access to the compromised host.

How the attack works

This is a supply-chain attack where a malicious software package is introduced into a public repository. When a developer or automated system installs the compromised package, the embedded malicious code executes during the installation process. The code then establishes an outbound connection to an attacker-controlled server, creating a backdoor that allows remote command execution on the affected system. The attack includes anti-analysis checks to evade detection in CI/CD environments or sandboxed systems, specifically targeting developer workstations.

Who's exposed

Profiles most at risk

  • Development teams using RubyGems
  • Developers who install RubyGems packages directly on their workstations
  • Organizations with CI/CD pipelines that build Ruby applications and pull dependencies from RubyGems.org

Conditions that increase exposure

  • Unpinned dependencies that allow fetching the latest or specific vulnerable versions
  • Lack of lockfiles (e.g., Gemfile.lock) to ensure consistent dependency versions
  • Use of internal mirrors or caches that do not validate package integrity
  • Installation of packages on developer workstations with sensitive files (e.g., ~/.ssh, ~/.gitconfig)

Blast-radius scenarios

  • An attacker gains an interactive remote shell on a developer's workstation, potentially leading to credential theft and lateral movement.
  • Compromise of build environments if the package is installed during CI/CD processes, although anti-analysis checks may limit this.
  • The attacker could access sensitive files and intellectual property stored on the compromised host.

What to do (defensive)

Detect

  • Scan RubyGems dependencies for known malicious packages, specifically 'xrp-ledger-utils' version 0.9.1.
  • Monitor network traffic for outbound connections to suspicious IP addresses, particularly 45.138.12.177:8089.
  • Implement file integrity monitoring for critical system binaries and configuration files.
  • Review system logs for unusual process execution, especially those involving `eval()` or `fork()` from Ruby processes.

Contain

  • Isolate any systems found to have installed 'xrp-ledger-utils' version 0.9.1 from the network.
  • Block outbound network connections to the identified C2 server (45.138.12.177:8089) at the network perimeter.
  • Temporarily suspend builds or deployments that rely on RubyGems if the scope of exposure is unclear.

Remediate

  • Remove 'xrp-ledger-utils' version 0.9.1 from all affected systems and development environments.
  • Rebuild compromised systems from trusted images or known good backups.
  • Rotate all credentials and API keys that may have been present on affected developer workstations or build environments.
  • Enforce strict dependency pinning and use lockfiles (e.g., Gemfile.lock) to prevent accidental installation of malicious versions.

Frontier verdict — High

Prioritize immediate detection and removal of 'xrp-ledger-utils' v0.9.1 due to critical severity and remote shell capabilities, especially on developer workstations.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.