MAL-2026-17783 Malicious code in defi-yield-calculator (RubyGems)

The gem ships an ext/extconf.rb that base64-decodes an embedded Ruby payload and runs it via eval inside a double-forked, detached, stdio-nulled background process after a 20–40 minute sleep. Execution is gated by anti-analysis checks that skip CI runners, ephemeral/sandbox hostnames, generated analyst usernames, common analysis working directories, low-uptime hosts, and hosts missing developer artifacts (~/.ssh, ~/.gitconfig, ~/.gem/credentials, ~/.bundle, ~/.npmrc), so the payload only fires on real developer machines. The decoded payload opens a TCPSocket to the hardcoded host 45.138.12.177 on port 8089 and bidirectionally pipes it to /bin/sh in an infinite reconnect loop, giving a remote operator persistent interactive shell access to the installer's host. The gemspec presents the package as a 'defi yield calculator' with a trivial lib stub exposing only VERSION/build_id/healthy?, the README is copied from an unrelated 'bitcoin-rpc-lite' project, and create_makefile targets 'bitcoin_rpc_lite_native' despite no C/C++ sources being shipped — the native-extension declaration exists solely to trigger the dropper during gem install.