Description

The gem declares ext/etherdum.rb/extconf.rb as a native extension, but the accompanying C source is an empty Init stub and the Ruby library is a trivial word list with no cryptography. extconf.rb, which RubyGems runs automatically on gem install, base64-decodes and evals a Ruby payload that XOR-decodes a hardcoded URL (http://45.138.217.89:2/wgkit.tar.gz, overridable via WG_KIT_URL), downloads a tarball to /tmp/.w1.tgz, extracts it, and executes wg_install.sh over plaintext HTTP from a bare IP. Execution is wrapped in a double-forked, detached child with stdio redirected to /dev/null and a 20-40 minute sleep before firing. Anti-analysis gating skips CI environments, ephemeral/sandbox hostnames (uvm, firecracker, sandbox, vagrant, fc-vm), generated-looking usernames (uA\d+, sandbox/tester/analys/scanner), analysis paths (/opt/rubygems, /tmp, /workspace), machines with uptime under 1800 seconds, and systems lacking developer artifacts, requiring the presence of ~/.ssh, ~/.gem/credentials, ~/.bundle,.gitconfig, or.npmrc before executing. The package name typosquats 'ethereum' and the native-extension declaration exists solely to trigger extconf.rb execution. Installing this gem on a developer workstation yields remote code execution via an unpinned, attacker-controlled shell script.

The OpenSSF Package Analysis project identified 'etherdum.rb' @ 1.0.0 (rubygems) as malicious.

It is considered malicious because:

The package executes one or more commands associated with malicious behavior.

Mitigation

Aliases

References