defi-yield-calculator

GHSA-qchc-hrjm-3rwv

Malicious code in defi-yield-calculator (RubyGems)

Details

**Severity:** Critical

**Affected versions:** `= 0.9.1`

## Source: amazon-inspector (ee8b3e50479b61d2ff6e2f5a19de20473cf8fc3c91f99945aff51f112a617192)
The gem ships an ext/extconf.rb that base64-decodes an embedded Ruby payload and runs it via eval inside a double-forked, detached, stdio-nulled background process after a 20–40 minute sleep. Execution is gated by anti-analysis checks that skip CI runners, ephemeral/sandbox hostnames, generated analyst usernames, common analysis working directories, low-uptime hosts, and hosts missing developer artifacts (~/.ssh, ~/.gitconfig, ~/.gem/credentials, ~/.bundle, ~/.npmrc), so the payload only fires on real developer machines. The decoded payload opens a TCPSocket to the hardcoded host 45.138.12.177 on port 8089 and bidirectionally pipes it to /bin/sh in an infinite reconnect loop, giving a remote operator persistent interactive shell access to the installer's host. The gemspec presents the package as a 'defi yield calculator' with a trivial lib stub exposing only VERSION/build_id/healthy?, the README is copied from an unrelated 'bitcoin-rpc-lite' project, and create_makefile targets 'bitcoin_rpc_lite_native' despite no C/C++ sources being shipped — the native-extension declaration exists solely to trigger the dropper during `gem install`.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/ff41f6680a0ebbef2268cdb5daf253d4b400cb05/osv/malicious/rubygems/defi-yield-calculator/MAL-2026-17783.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/ff41f6680a0ebbef2268cdb5daf253d4b400cb05/osv/malicious/rubygems/defi-yield-calculator/MAL-2026-17783.json
- https://rubygems.org/gems/defi-yield-calculator/versions/0.9.1
- https://github.com/advisories/GHSA-qchc-hrjm-3rwv

Compromised versions (1)

= 0.9.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.