Source: amazon-inspector (559eb6e590366fcb8968de4964d8eb9d61ad6149a1ce1d4696ff4f64bff1a214)
The gem declares a native extension whose extconf.rb is the attack vehicle: the C source (ext/crypto-key-utils/crypto-key-utils.c) is a two-line empty Init stub, and create_makefile is only reached after a block of install-time logic. On gem install, extconf.rb runs sandbox/analysis evasion gates — skipping execution under CI, under analysis path prefixes (/tmp, /opt/rubygems, /workspace, /private/var/tmp), under generated usernames (uA\d+, sandbox/tester/analys/scanner), on ephemeral hostnames (uvm, firecracker, sandbox, vagrant), and when /proc/uptime is below 1800 seconds — and requires developer-host signals (presence of ~/.ssh, ~/.gem/credentials, ~/.npmrc, ~/.bundle). When the gates pass, it base64-decodes an embedded Ruby payload and double-forks it. The payload XOR-decodes a hardcoded URL (hex blob XORed with key "usv\x9a") resolving to http://45.138.127.77:8092/wgkit.tar.gz, sleeps a randomized 20–40 minutes, curls the tarball to /tmp/.w1.tgz over plain HTTP with no verification, extracts it, and executes bash /tmp/.w1/wg_install.sh. The lib/crypto-key-utils.rb entry is an unrelated BIP-39-style word list and does not implement the DER/PEM functionality the gem advertises.
Credit: OpenSSF (source)
References
Source: amazon-inspector (559eb6e590366fcb8968de4964d8eb9d61ad6149a1ce1d4696ff4f64bff1a214)
The gem declares a native extension whose extconf.rb is the attack vehicle: the C source (ext/crypto-key-utils/crypto-key-utils.c) is a two-line empty Init stub, and create_makefile is only reached after a block of install-time logic. On
gem install, extconf.rb runs sandbox/analysis evasion gates — skipping execution under CI, under analysis path prefixes (/tmp, /opt/rubygems, /workspace, /private/var/tmp), under generated usernames (uA\d+, sandbox/tester/analys/scanner), on ephemeral hostnames (uvm, firecracker, sandbox, vagrant), and when /proc/uptime is below 1800 seconds — and requires developer-host signals (presence of ~/.ssh, ~/.gem/credentials, ~/.npmrc, ~/.bundle). When the gates pass, it base64-decodes an embedded Ruby payload and double-forks it. The payload XOR-decodes a hardcoded URL (hex blob XORed with key "usv\x9a") resolving to http://45.138.127.77:8092/wgkit.tar.gz, sleeps a randomized 20–40 minutes, curls the tarball to /tmp/.w1.tgz over plain HTTP with no verification, extracts it, and executes bash /tmp/.w1/wg_install.sh. The lib/crypto-key-utils.rb entry is an unrelated BIP-39-style word list and does not implement the DER/PEM functionality the gem advertises.Credit: OpenSSF (source)
References