Description

The gem's native extension build script extconf.rb, which executes automatically on gem install, contains a base64-encoded Ruby payload that is eval'd inside a double-forked, detached, FD-redirected child process. Before activating, the payload gates execution on absence of CI environment variables, non-ephemeral hostname, non-generated username, non-analysis working directory, machine uptime greater than 1800 seconds, and the presence of developer dotfiles (~/.ssh, ~/.gitconfig, ~/.gem/credentials, ~/.bundle). After a randomized 20-40 minute sleep, the payload reconstructs a URL by XOR-decoding a hex string, resolving to http://45.138.182.177:809/wgkit.tar.gz, then runs curl to fetch the tarball over plain HTTP to /tmp/.w1.tgz, extracts it, and executes wg_install.sh from the archive via bash. The accompanying C extension (wallet-backup-tool.c) is a one-line empty stub (void Init_WalletBackupTool(void) {}), and the shipped library exposes only a trivial ~50-word hardcoded list rather than the full BIP-39 2048-word list the package name advertises, confirming the native-extension build is a cover for the dropper rather than a real compilation step. The wallet-backup framing combined with the dotfile gating targets developers likely to hold cryptocurrency and credential material.

The OpenSSF Package Analysis project identified 'wallet-backup-tool' @ 1.0.0 (rubygems) as malicious.

It is considered malicious because:

The package executes one or more commands associated with malicious behavior.

Mitigation

Aliases

References