Malicious perp-funding-rates gem poses as the bitcoin-rpc-lite library and opens a reverse shell during installation

A package named perp-funding-rates has been found on RubyGems whose README describes the bitcoin-rpc-lite library and whose native extension name repeats that name — yet the package contains no build source files. The extension script exists solely to execute code during `gem install`: it decodes a base64 payload and launches it in a detached child process with a delay, then connects to a hardcoded command server and forwards /bin/sh to it. Execution is enabled only on machines showing signs of developer use — the presence of SSH directories and files, RubyGems credentials, git, npm and bundler configurations — meaning the targets are workstations and build systems. For the developer, this gives the attacker interactive access to a machine holding signing keys, tokens and access to infrastructure.