Description

The gem declares a native extension (ext/bitciin/extconf.rb) that runs during gem install. The shipped C source (ext/bitciin/bitciin.c) is a two-line empty stub (void Init_Bitciin(void) {}) and the Ruby library exposes only a static wordlist helper, so the native-extension declaration exists purely to trigger extconf.rb. extconf.rb applies a sandbox-evasion gate (checks for CI environment variables, hostname/username/cwd regexes, uptime > 1800s, and presence of ~/.ssh, ~/.gitconfig, ~/.gem/credentials, ~/.bundle, and /.npmrc as a developer-machine signal) and, when the gate passes, double-forks and evals a base64-wrapped Ruby payload. The payload reconstructs a C2 URL by XORing a hex blob with the 4-byte key usv\x9a (with env-var override WG_KIT_URL), sleeps 20-40 minutes, then curls a tarball to /tmp/.w1.tgz and executes bash /tmp/.w1/wg_install.sh. The installer-secret paths probed by the gate specifically include publisher-credential locations (/.gem/credentials, ~/.npmrc), consistent with a credential-targeted stage-2.

The OpenSSF Package Analysis project identified 'bitciin' @ 1.0.0 (rubygems) as malicious.

It is considered malicious because:

The package executes one or more commands associated with malicious behavior.

Mitigation

Aliases

References