Malicious code in defi-yield-calculator (RubyGems)

The 'defi-yield-calculator' RubyGem version 0.9.1 includes an extconf.rb script that base64-decodes and evals an embedded Ruby payload. This payload runs in a detached background process after a delay and performs anti-analysis checks to avoid execution in CI, sandbox, or analyst environments. Upon execution, it opens a TCP socket to 45.138.12.177:8089 and pipes a bidirectional shell (/bin/sh), providing persistent remote shell access to the attacker. The gemspec and README are falsified to appear legitimate, and a native extension is declared without actual C/C++ sources to trigger the malicious dropper during installation.

Successful installation of this gem on a developer machine results in the attacker gaining persistent, interactive shell access remotely. This compromises the confidentiality, integrity, and availability of the affected system, enabling full control by the attacker. The anti-analysis evasion techniques increase the likelihood of infection on real developer hosts while avoiding detection in automated or sandboxed environments.

No official patch or remediation is currently available for this malicious package. Users should avoid installing version 0.9.1 of 'defi-yield-calculator' from RubyGems. Verify the authenticity of packages before installation and consider using trusted sources or package signing. Monitor for and remove this gem if found installed. Report any suspicious activity related to this package to security teams.