Which versions of wallet-hd-derive are malicious?

The following RubyGems versions of wallet-hd-derive are flagged malicious: 0.9.1. Treat any of these as compromised.

How do I remediate wallet-hd-derive if I installed it?

wallet-hd-derive is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.

I already installed wallet-hd-derive — how do I know if it already compromised me?

If wallet-hd-derive was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is wallet-hd-derive part of a known attack campaign?

Yes — wallet-hd-derive is associated with the IN-MAL-2026-021363 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find wallet-hd-derive across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for wallet-hd-derive (version 0.9.1).

Malicious package

wallet-hd-deriveRubyGems

Advisory published Oct 11, 2026Updated Oct 13, 2026

wallet-hd-derive is a confirmed malicious RubyGems package (MAL-2026-17800) that steals credentials and exfiltrates sensitive data (malicious version 0.9.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in wallet-hd-derive (RubyGems)

MAL-2026-17800

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

gem uninstall wallet-hd-derive

What this malware does

The gem is published as a crypto wallet utility but ships no native source; its gemspec declares extconf.rb as an extension so that gem install auto-executes it. extconf.rb decodes a base64-encoded Ruby payload and, after checking for sandbox and analysis signals (CI env, ephemeral hostnames, generated usernames matching patterns such as uA\d+/sandbox/tester/analys/scanner, cwd under /tmp, /opt/rubygems, /workspace, low machine uptime) and confirming developer-identifying files (~/.ssh, ~/.gem/credentials, etc.), double-forks a detached process via fork + Process.setsid, sleeps for 20–40 minutes, then opens a TCP connection to 45.138.12.177:8089 and pipes /bin/sh in both directions using TCPSocket and IO.popen/IO.copy_stream. The shipped library at lib/wallet_hd_derive.rb exposes only two no-op methods (build_id='ok', healthy?=true) and the README is branded for an unrelated package (bitcoin-rpc-lite), confirming the gem exists solely as a delivery vehicle for the install-time backdoor. The destination IP, base64 encoding of the payload, sandbox-evasion gating, and delayed reverse-shell establishment give a remote operator interactive /bin/sh on any developer or CI host that installs the gem.

The OpenSSF Package Analysis project identified 'wallet-hd-derive' @ 0.9.1 (rubygems) as malicious.

It is considered malicious because:

The package executes one or more commands associated with malicious behavior.

Malicious versions

1 flagged

0.9.1

Indicators of compromise (SHA-256)

fdfb31a6866dee961d55ad503da9de33a2cf743b52c80862e4380519ad5bef12

4630595f8934769aa5dc9e63f62e4552e3cb3663dc5f03e5def0deeb3a8476e1

Detection & response playbook

Credential / info stealer

Find it
Search your lockfiles and build artifacts for wallet-hd-derive (version 0.9.1).
If you installed it — respond
wallet-hd-derive is built to steal secrets, so assume every credential the build or runtime could read is compromised. Remove it from your project and lockfile, then rotate ALL exposed secrets — npm/registry tokens, cloud keys, CI/CD secrets, SSH keys, and any .env values — from a known-clean machine. Audit logs for unauthorized use of those credentials.
Did it already run?
If wallet-hd-derive was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. wallet-hd-derive on RubyGems has been identified as a malicious package (version 0.9.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-021363

References

rubygems.org

Credits

Amazon Inspector · finder
OpenSSF: Package Analysis · finder

Detect & block this

O3 blocks wallet-hd-derive-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the credential exfiltration and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database