Malicious code in defi-yield-calculator (RubyGems)

Source: amazon-inspector ee8b3e50479b61d2ff6e2f5a19de20473cf8fc3c91f99945aff51f112a617192 The gem ships an ext/extconf.rb that base64-decodes an embedded Ruby payload and runs it via eval inside a double-forked, detached, stdio-nulled background process after a 20–40 minute sleep. Execution is...

Malicious code in defi-yield-calculator (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee8b3e50479b61d2ff6e2f5a19de20473cf8fc3c91f99945aff51f112a617192 The gem ships an ext/extconf.rb that base64-decodes an embedded Ruby payload and runs it via eval inside a double-forked, detached, stdio-nulled...

MAL-2026-17792 Malicious code in nft-metadata-resolver (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee87c382dfd443e81b4cf0e8dc66749f9a129bd4239f984859aaaf760e84c629 The gem ships a native-extension script at ext/nftmetadataresolver/extconf.rb that RubyGems auto-executes during gem install. The script carries a...

Malicious code in throttle-requests (RubyGems)

Source: amazon-inspector ff1a325fc41cbb1dd7c949031e75946ce0f5f522bae7f63371dcc2c93589ec5d The gem's native-extension build script extconf.rb base64-decodes an embedded Ruby payload, writes it to a random path in the temporary directory, and spawns it in the background before running the normal mk...

MAL-2026-17567 Malicious code in rate-limit-mini (RubyGems)

RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...