Description

The gem advertises Ethereum transaction helpers but ships only an empty C stub (ext/ethereum-tx-helper/ethereum-tx-helper.c: Init_EthereumTxHelper(){}) and a tiny BIP39 word-list helper in lib. All real behavior lives in ext/ethereum-tx-helper/extconf.rb, which runs during gem install as the native-extension build step. extconf.rb executes an eval() of a base64-encoded Ruby payload that first fingerprints the host for analysis/CI/sandbox markers and for developer-machine signals (~/.ssh, ~/.gem/credentials, ~/.gitconfig, ~/.npmrc, ~/.bundle); on a host that looks like a real developer workstation it double-forks a detached background process, sleeps 20-40 minutes to evade sandbox timing, then curls a tarball from a bare-IP endpoint at http://45.138.122.177:8092/wgkit.tar.gz into /tmp/.w1.tgz and executes bash /tmp/.w1/wg_install.sh. The destination URL is not present in cleartext — it is reconstructed at runtime by XOR-decoding a hex blob against the 4-byte key "usv\x9a", specifically to defeat static URL extraction. The package name and homepage (ethereum-tx-helper.dev) impersonate a crypto-developer utility to attract installs by developers whose machines are the exact targets the dropper's gating selects for.

The OpenSSF Package Analysis project identified 'ethereum-tx-helper' @ 1.0.0 (rubygems) as malicious.

It is considered malicious because:

The package executes one or more commands associated with malicious behavior.

Mitigation

Aliases

References