lita-coin 0.0.3 contains a backdoor mechanism that allows launching of hidden cryptocurrency mining operations inside the project. The code also contained a backdoor mechanism that allowed the attacker to send a cookie file back to a compromised project, and allow the attacker to execute malicious commands.

References

• https://nvd.nist.gov/vuln/detail/CVE-2019-15224
• https://www.zdnet.com/article/backdoor-code-found-in-11-ruby-libraries/