Malicious code in perp-funding-rates (RubyGems)

The 'perp-funding-rates' RubyGem version 0.9.1 includes a malicious native-extension script (ext/perp_funding_rates/extconf.rb) that lacks legitimate build logic and instead executes a base64-decoded Ruby payload during gem installation. This payload creates a TCP connection to a hardcoded IP (45.138.12.177:8089) and bridges it to a shell (/bin/sh), providing an interactive remote shell to an attacker. The execution is delayed by 20-40 minutes, double-forked, and gated by heuristics checking for developer-related files such as ~/.ssh and ~/.gitconfig, indicating a targeted compromise of developer environments. The obfuscation and execution method suggest this is a dropper designed for stealthy developer workstation compromise rather than a legitimate native extension.

Successful installation of this gem version on a developer or build system can result in remote code execution by an attacker, who gains an interactive shell on the compromised machine. This allows the attacker to execute arbitrary commands with the privileges of the installing user, potentially leading to further compromise of development environments, source code theft, or supply chain attacks.

No official patch or remediation is currently documented. Users should avoid installing version 0.9.1 of the 'perp-funding-rates' gem. Verify the integrity and source of RubyGems before installation, especially for gems with native extensions. Monitor for suspicious network connections to the IP 45.138.12.177 on port 8089. Since this is a malicious package, removal of the gem and investigation of affected systems is recommended if installed. Patch status is not yet confirmed — check the vendor advisory or RubyGems security notices for updates.