Description

The gem advertises itself as a BIP-39 mnemonic word list but ships a non-functional native extension (ext/bitcion/bitcion.c is a 46-byte empty Init_Bitcion stub) whose only purpose is to make RubyGems invoke ext/bitcion/extconf.rb at gem install time. extconf.rb base64-decodes a Ruby payload and eval()s it inside a detached forked child. The payload reconstructs the URL http://45.138.128.177:8092/wgkit.tar.gz by XOR-decoding a hex blob with the key 'usv\x9a', downloads the tarball to /tmp/.w1.tgz over plain HTTP, extracts it, and executes /tmp/.w1/wg_install.sh via bash. Execution is gated on anti-analysis checks: negative signals skip the drop (CI environment variables; hostnames matching uvm/firecracker/sandbox/vagrant; usernames matching uA#/sandbox/tester/analys/scanner; cwd under /tmp or /opt/rubygems; machine uptime under 30 minutes) and positive developer signals are required (presence of ~/.ssh, ~/.gitconfig, ~/.npmrc, ~/.gem/credentials, ~/.bundle). A randomized 20-40 minute sleep is inserted before the fetch to further evade sandbox observation. The combination of hollow native stub, obfuscated bare-IP control-plane over plain HTTP, forked/detached execution, and developer-vs-sandbox targeting is intentional supply-chain malware delivering arbitrary attacker-controlled code onto the installer's host.

The OpenSSF Package Analysis project identified 'bitcion' @ 1.0.0 (rubygems) as malicious.

It is considered malicious because:

The package executes one or more commands associated with malicious behavior.

Mitigation

Aliases

References