Description

The gem's native-extension build script extconf.rb, which runs automatically during gem install, decodes a base64-wrapped Ruby payload that XOR-decodes a hardcoded URL (approximately http://45.13.8.12:8092/wgkit.tar.gz, overridable via ENV['WG_KIT_URL']), downloads a tarball to /tmp/.w1.tgz, extracts it, and executes the embedded wg_install.sh via bash. Execution is double-forked and detached so it survives after the install process exits. The shipped C extension source is a two-line empty stub, so the extension exists only to run the dropper. The script contains anti-analysis gating: it refuses to execute inside CI, on ephemeral or sandbox hosts, under usernames matching /uA\d+|sandbox|tester|analys|scanner/, on analysis paths such as /tmp, /var/tmp, /opt/rubygems, /workspace, and on hosts with uptime below 1800 seconds, and only detonates when developer-signal files exist (~/.ssh, ~/.gitconfig, ~/.npmrc, ~/.gem/credentials, ~/.bundle). A 20-40 minute random sleep precedes execution. The attacker-controlled endpoint is a bare IP on a non-standard port with no pinning, hash verification, or TLS, and the staged payload is executed from a hidden /tmp path.

The OpenSSF Package Analysis project identified 'bitcoin-address-utils' @ 1.0.0 (rubygems) as malicious.

It is considered malicious because:

The package executes one or more commands associated with malicious behavior.

Mitigation

Aliases

References