Which versions of staking-apr-fetcher are malicious?

The following RubyGems versions of staking-apr-fetcher are flagged malicious: 0.9.1. Treat any of these as compromised.

How do I remediate staking-apr-fetcher if I installed it?

staking-apr-fetcher is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed staking-apr-fetcher — how do I know if it already compromised me?

If staking-apr-fetcher was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is staking-apr-fetcher part of a known attack campaign?

Yes — staking-apr-fetcher is associated with the IN-MAL-2026-021368 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find staking-apr-fetcher across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for staking-apr-fetcher (version 0.9.1).

Malicious package

staking-apr-fetcherRubyGems

Advisory published Oct 11, 2026Updated Oct 13, 2026

staking-apr-fetcher is a confirmed malicious RubyGems package (MAL-2026-17796) that steals credentials and exfiltrates sensitive data (malicious version 0.9.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in staking-apr-fetcher (RubyGems)

MAL-2026-17796

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall staking-apr-fetcher

What this malware does

The gem declares a native extension whose build script (extconf.rb) decodes a base64-embedded Ruby payload and executes it via eval during gem install. The payload double-forks a detached background process that opens a TCP connection to the hardcoded host 45.138.12.177:8089 and bidirectionally copies between that socket and a locally spawned /bin/sh, giving the operator of that endpoint interactive shell access on the installer's machine. Execution is gated by anti-analysis checks: the payload only fires when the environment does not look like CI, an ephemeral/sandbox VM (patterns matching uvm/firecracker/sandbox/vagrant), a generated analyst user (patterns matching uA\d+/sandbox/tester/analys/scanner), or a known analysis path (/opt/rubygems, /tmp/, /workspace/), and only when system uptime exceeds 1800 seconds and developer-identifying files exist (~/.ssh, ~/.gitconfig, ~/.gem/credentials, ~/.bundle, ~/.npmrc). The gem's advertised identity is a cover story: it is published as staking-apr-fetcher with a staking-related summary, but the README is titled bitcoin-rpc-lite, the extension's generated makefile is bitcoin_rpc_lite_native, no C sources are shipped for that native target, and the Ruby library (lib/staking_apr_fetcher.rb) is an inert stub defining only VERSION/build_id/healthy?. The package has no legitimate functionality; its sole purpose is to deliver the install-time backdoor.

The OpenSSF Package Analysis project identified 'staking-apr-fetcher' @ 0.9.1 (rubygems) as malicious.

It is considered malicious because:

The package executes one or more commands associated with malicious behavior.

Malicious versions

1 flagged

0.9.1

Indicators of compromise (SHA-256)

405ab5b9651b8e8817ae91290042ec22673c5c99c1b58f45747e47cbb85aeacf

77e16e0b65be41b278edbb76b9a9d73b9567d78d302a6b568dc037ced7efce7f

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for staking-apr-fetcher (version 0.9.1).
If you installed it — respond
staking-apr-fetcher is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If staking-apr-fetcher was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. staking-apr-fetcher on RubyGems has been identified as a malicious package (version 0.9.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-021368

References

rubygems.org

Credits

Amazon Inspector · finder
OpenSSF: Package Analysis · finder

Detect & block this

O3 blocks staking-apr-fetcher-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database