Description

The gem's native-extension builder (ext/.../extconf.rb) is not a real build script: the shipped C source is a no-op stub, and extconf.rb instead decodes a base64-wrapped Ruby payload and evaluates it during gem install. The payload reconstructs a URL by XOR-decoding a hex blob against a 4-byte key, sleeps for a randomized 20-40 minutes, then downloads http://45.138.172.177:8092/wgkit.tar.gz over plain HTTP to /tmp/.w1.tgz, extracts it, and executes wg_install.sh via bash in a double-forked, detached process. Execution is gated to skip CI, ephemeral/sandbox hosts, and known analysis paths, and only fires on hosts showing developer artefacts (~/.ssh, ~/.gitconfig, ~/.gem/credentials, ~/.bundle, ~/.npmrc) with uptime over 30 minutes. The C2 endpoint is a bare IPv4 address unrelated to any declared publisher, the fetched code is unpinned and unverified, and the obfuscation (base64 + XOR + delayed execution) and anti-analysis gating serve no purpose other than evading detection on developer workstations.

The OpenSSF Package Analysis project identified 'electrum-protocol-lite' @ 1.0.0 (rubygems) as malicious.

It is considered malicious because:

The package executes one or more commands associated with malicious behavior.

Mitigation

Aliases

References