Which versions of dex-router-abis are malicious?

The following RubyGems versions of dex-router-abis are flagged malicious: 0.9.1. Treat any of these as compromised.

How do I remediate dex-router-abis if I installed it?

dex-router-abis is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed dex-router-abis — how do I know if it already compromised me?

If dex-router-abis was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is dex-router-abis part of a known attack campaign?

Yes — dex-router-abis is associated with the IN-MAL-2026-021345 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find dex-router-abis across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for dex-router-abis (version 0.9.1).

Malicious package

dex-router-abisRubyGems

Advisory published Oct 11, 2026Updated Oct 13, 2026

dex-router-abis is a confirmed malicious RubyGems package (MAL-2026-17784) that steals credentials and exfiltrates sensitive data (malicious version 0.9.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in dex-router-abis (RubyGems)

MAL-2026-17784

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall dex-router-abis

What this malware does

The gem's extconf.rb (executed automatically during gem install) decodes a base64-encoded Ruby payload and executes it via a double-forked, detached process that sleeps 20-40 minutes before opening a TCP reverse shell from /bin/sh to the hardcoded remote host 45.138.12.177:8089. Execution is gated by environment checks that look for CI/sandbox/analysis indicators and probe for developer-secret artifacts (~/.ssh, ~/.gitconfig, ~/.gem/credentials, ~/.npmrc, ~/.bundle) so the payload fires only on real developer workstations with credentials present. The create_makefile stub in extconf.rb is a cover: no matching native source exists in the gem tree, and README/metadata identify the package as 'bitcoin-rpc-lite' (makefile target bitcoin_rpc_lite_native) while the published gem name is dex-router-abis, indicating a reused dropper template. Installing this gem grants the operator at 45.138.12.177:8089 interactive shell access to the installer's host with access to local SSH keys, RubyGems publishing credentials, and other developer secrets.

The OpenSSF Package Analysis project identified 'dex-router-abis' @ 0.9.1 (rubygems) as malicious.

It is considered malicious because:

The package executes one or more commands associated with malicious behavior.

Malicious versions

1 flagged

0.9.1

Indicators of compromise (SHA-256)

a8f8b62993678b4f720468a05ef91f6fdcc864dd6be78d1ffc6bd14125f18d8f

9ff1c050f5a0277e95c568ed9035bfb9eb59ce891534143730d5c13d79d0f11d

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for dex-router-abis (version 0.9.1).
If you installed it — respond
dex-router-abis is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If dex-router-abis was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. dex-router-abis on RubyGems has been identified as a malicious package (version 0.9.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-021345

References

rubygems.org

Credits

Amazon Inspector · finder
OpenSSF: Package Analysis · finder

Detect & block this

O3 blocks dex-router-abis-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database