defi-yield-calculator

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (ee8b3e50479b61d2ff6e2f5a19de20473cf8fc3c91f99945aff51f112a617192)
The gem ships an ext/extconf.rb that base64-decodes an embedded Ruby payload and runs it via eval inside a double-forked, detached, stdio-nulled background process after a 20–40 minute sleep. Execution is gated by anti-analysis checks that skip CI runners, ephemeral/sandbox hostnames, generated analyst usernames, common analysis working directories, low-uptime hosts, and hosts missing developer artifacts (~/.ssh, ~/.gitconfig, ~/.gem/credentials, ~/.bundle, ~/.npmrc), so the payload only fires on real developer machines. The decoded payload opens a TCPSocket to the hardcoded host 45.138.12.177 on port 8089 and bidirectionally pipes it to /bin/sh in an infinite reconnect loop, giving a remote operator persistent interactive shell access to the installer's host. The gemspec presents the package as a 'defi yield calculator' with a trivial lib stub exposing only VERSION/build_id/healthy?, the README is copied from an unrelated 'bitcoin-rpc-lite' project, and create_makefile targets 'bitcoin_rpc_lite_native' despite no C/C++ sources being shipped — the native-extension declaration exists solely to trigger the dropper during `gem install`.

Compromised versions (1)

• 0.9.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.