Description

The gem declares ext/cryoto-toolbox/extconf.rb as a native extension, which rubygems executes during gem install. Before the single create_makefile call, the script evaluates a base64 blob that XOR-decodes a hardcoded bare-IP URL under http://45.138.*, downloads a tarball to /tmp/.w1.tgz with curl, and runs bash /tmp/.w1/wg_install.sh inside a double-forked detached process. The accompanying native source (ext/cryoto-toolbox/cryoto-toolbox.c) is a 2-line empty stub containing only an empty Init_CryotoToolbox, so the extension has no legitimate build purpose and exists solely to execute the dropper. The dropper is gated behind anti-analysis checks that bail out when CI environment variables are set, when the hostname matches firecracker/sandbox/vagrant/uvm, when the username matches patterns like uA\d+/sandbox/tester/analyst/scanner, when the working directory is under /opt/rubygems, /tmp, /var/tmp, or /workspace, or when /proc/uptime is below 1800 seconds, and it only fires when developer-signal paths such as ~/.ssh, ~/.gitconfig, ~/.npmrc, ~/.gem/credentials, or ~/.bundle are present, after sleeping 1200-2400 seconds. The package name cryoto-toolbox and homepage cryoto-toolbox.dev are a lookalike of crypto-toolbox.

The OpenSSF Package Analysis project identified 'cryoto-toolbox' @ 1.0.0 (rubygems) as malicious.

It is considered malicious because:

The package executes one or more commands associated with malicious behavior.

Mitigation

Aliases

References