MAL-2026-17783
Dashboard / Malicious Package / MAL-2026-17783
MAL-2026-17783
Summary: Malicious code in defi-yield-calculator (RubyGems)
Details: Source: amazon-inspector (ee8b3e50479b61d2ff6e2f5a19de20473cf8fc3c91f99945aff51f112a617192) The gem ships an ext/extconf.rb that base64-decodes an embedded Ruby payload and runs it via eval inside a double-forked, detached, stdio-nulled background process after a 20–40 minute sleep. Execution is gated by anti-analysis checks that skip CI runners, ephemeral/sandbox hostnames, generated analyst usernames, common analysis working directories, low-uptime hosts, and hosts missing developer artifacts (~/.ssh, ~/.gitconfig, ~/.gem/credentials, ~/.bundle, ~/.npmrc), so the payload only fires on real developer machines. The decoded payload opens a TCPSocket to the hardcoded host 45.138.12.177 on port 8089 and bidirectionally pipes it to /bin/sh in an infinite reconnect loop, giving a remote operator persistent interactive shell access to the installer's host. The gemspec presents the package as a 'defi yield calculator' with a trivial lib stub exposing only VERSION/build_id/healthy?, the README is copied from an unrelated 'bitcoin-rpc-lite' project, and create_makefile targets 'bitcoin_rpc_lite_native' despite no C/C++ sources being shipped — the native-extension declaration exists solely to trigger the dropper during `gem install`.
Affected packages
Package
Name: defi-yield-calculator
Purl: pkg:gem/defi-yield-calculator
Affected ranges
Type: N/A
Events:
