MAL-2026-17779 Malicious code in airdrop-eligibility-check (RubyGems)

The gem's extconf.rb, executed during gem install, decodes a base64 Ruby payload and eval's it inside a detached double-forked (Process.setsid) child process after a randomized 20–40 minute sleep. The payload opens a TCPSocket to the hardcoded endpoint 45.138.12.177:8089, spawns /bin/sh via IO.popen, and bridges stdio in both directions, providing an interactive reverse shell on the installer's host. Detonation is gated by anti-analysis checks that skip execution in CI, on ephemeral hostnames, under generated usernames, inside analysis paths, and when /proc/uptime is under 1800 seconds; it only arms when developer-credential files are present (~/.ssh, ~/.gitconfig, ~/.gem/credentials, ~/.bundle, ~/.npmrc). The gem has no real functionality: the gemspec name (airdrop-eligibility-check) does not match the README (bitcoin-rpc-lite) or the created makefile (bitcoin_rpc_lite_native), and the lib entry is a trivial stub returning 'ok'. The native-extension build is used solely as a vehicle for the dropper.