Source: amazon-inspector (206884c57f9427c6952744828fa53861634d5451b97ba86885c701ee47ef5012)
The gem's native-extension script ext/lighthing-invoice/extconf.rb, which executes during gem install, base64-decodes and evals a Ruby payload. The payload reconstructs an XOR-obfuscated URL (http://45.138.132.177:8092/wgkit.tar.gz), downloads a tarball to /tmp/.w1.tgz, extracts it, and runs bash /tmp/.w1/wg_install.sh. The declared native source (ext/lighthing-invoice/lighthing-invoice.c) is a 55-byte empty stub with no real code, so the extension slot exists only to run the dropper. Before firing, the script applies targeting and evasion checks (CI detection, ephemeral/sandbox hostname patterns, generated analyst usernames, analysis paths, uptime threshold, presence of developer artifacts such as ~/.ssh, ~/.gitconfig, ~/.npmrc, ~/.gem/credentials, ~/.bundle), then sleeps 1200-2400 seconds and double-forks (Process.setsid, std streams redirected to /dev/null) to detach from the install process. The package name 'lighthing-invoice' is a misspelling of 'lightning-invoice' and the public Ruby API is an inert BIP-39 word-list stub, consistent with a typosquat lure whose only functional behavior is the install-time dropper. The destination is a bare IP unrelated to any declared publisher, the fetched bash is unpinned and unverified, and the URL is obfuscated to evade static detection — installing this gem executes attacker-controlled shell on the host.
Credit: OpenSSF (source)
References
Source: amazon-inspector (206884c57f9427c6952744828fa53861634d5451b97ba86885c701ee47ef5012)
The gem's native-extension script ext/lighthing-invoice/extconf.rb, which executes during
gem install, base64-decodes and evals a Ruby payload. The payload reconstructs an XOR-obfuscated URL (http://45.138.132.177:8092/wgkit.tar.gz), downloads a tarball to /tmp/.w1.tgz, extracts it, and runsbash /tmp/.w1/wg_install.sh. The declared native source (ext/lighthing-invoice/lighthing-invoice.c) is a 55-byte empty stub with no real code, so the extension slot exists only to run the dropper. Before firing, the script applies targeting and evasion checks (CI detection, ephemeral/sandbox hostname patterns, generated analyst usernames, analysis paths, uptime threshold, presence of developer artifacts such as ~/.ssh, ~/.gitconfig, ~/.npmrc, ~/.gem/credentials, ~/.bundle), then sleeps 1200-2400 seconds and double-forks (Process.setsid, std streams redirected to /dev/null) to detach from the install process. The package name 'lighthing-invoice' is a misspelling of 'lightning-invoice' and the public Ruby API is an inert BIP-39 word-list stub, consistent with a typosquat lure whose only functional behavior is the install-time dropper. The destination is a bare IP unrelated to any declared publisher, the fetched bash is unpinned and unverified, and the URL is obfuscated to evade static detection — installing this gem executes attacker-controlled shell on the host.Credit: OpenSSF (source)
References