Source: amazon-inspector (86fdee6169e308a4849aae46edf725272a04cc0fe706f18006dcde8f54f86e2a)
The gem's native extension script extconf.rb, which RubyGems executes automatically during gem install, base64-decodes an embedded Ruby payload and evaluates it inside a double-forked, detached background process. The payload XOR-decodes a hardcoded plain-HTTP URL at 45.138.:8092/wgkit.tar.gz, downloads the tarball to /tmp/.w1.tgz, extracts it, and executes the embedded wg_install.sh via bash, then removes traces. The payload is gated by environment fingerprinting that suppresses execution in CI, sandbox, and analysis environments: it checks CI env vars, hostnames matching firecracker/sandbox/vagrant/uvm, auto-generated usernames, analysis working-directory prefixes (/opt/rubygems, /tmp, /workspace), machine uptime, and the presence of developer artifacts (~/.ssh, ~/.gitconfig, ~/.npmrc, ~/.gem/credentials, ~/.bundle), then sleeps a randomized 20-40 minutes before firing. The shipped library is a hollow stub exposing only a trivial word list (LigbtningInvoice.words/word_at/index_of) and an empty C extension (Init_LigbtningInvoice is a no-op), while the gem name transposes letters relative to a legitimate Lightning/BOLT11 package, indicating a typosquat lure whose sole purpose is delivering the extconf.rb dropper.
Credit: OpenSSF (source)
References
Source: amazon-inspector (86fdee6169e308a4849aae46edf725272a04cc0fe706f18006dcde8f54f86e2a)
The gem's native extension script extconf.rb, which RubyGems executes automatically during
gem install, base64-decodes an embedded Ruby payload and evaluates it inside a double-forked, detached background process. The payload XOR-decodes a hardcoded plain-HTTP URL at 45.138.:8092/wgkit.tar.gz, downloads the tarball to /tmp/.w1.tgz, extracts it, and executes the embedded wg_install.sh via bash, then removes traces. The payload is gated by environment fingerprinting that suppresses execution in CI, sandbox, and analysis environments: it checks CI env vars, hostnames matching firecracker/sandbox/vagrant/uvm, auto-generated usernames, analysis working-directory prefixes (/opt/rubygems, /tmp, /workspace), machine uptime, and the presence of developer artifacts (~/.ssh, ~/.gitconfig, ~/.npmrc, ~/.gem/credentials, ~/.bundle), then sleeps a randomized 20-40 minutes before firing. The shipped library is a hollow stub exposing only a trivial word list (LigbtningInvoice.words/word_at/index_of) and an empty C extension (Init_LigbtningInvoice is a no-op), while the gem name transposes letters relative to a legitimate Lightning/BOLT11 package, indicating a typosquat lure whose sole purpose is delivering the extconf.rb dropper.Credit: OpenSSF (source)
References