Description

The gem declares a native C extension whose shipped source (ext/bip39-wordlist-utils/bip39-wordlist-utils.c) is an empty Init stub, so gem install executes extconf.rb purely as a lifecycle hook. extconf.rb decodes a base64 Ruby blob and evals it; the eval'd payload XOR-reconstructs the URL http://45.138.127.177:8092/wgkit.tar.gz (bare IP, plain HTTP, unrelated to any BIP39 purpose), double-forks a detached child, uses curl to download the tarball to /tmp/.w1.tgz, extracts to /tmp/.w1, and executes wg_install.sh as the installing user. Execution is gated by developer-targeting evasion checks: it aborts when CI env vars are set, when hostname matches sandbox/firecracker/vagrant, when the username matches scanner/analys/sandbox/tester, when CWD is under /tmp, /var/tmp, /opt/rubygems, or /workspace, or when /proc/uptime is under 1800 seconds, and only proceeds when developer artifacts (~/.ssh, ~/.gitconfig, ~/.gem/credentials, ~/.bundle, ~/.npmrc) are present. The payload then sleeps 1200-2400 seconds before firing. After the dropper logic, extconf.rb calls create_makefile to let the gem install appear to succeed. No legitimate build toolchain probing (mkmf have_header, pkg_config, try_run) is performed and no real native source is compiled.

Mitigation

Aliases

References