Description

The gem lightinng-invoice is a typosquat of the Lightning/BOLT11 ecosystem (duplicated 'n', homepage lightinng-invoice.dev) whose advertised functionality is a decoy: lib/lightinng-invoice.rb exposes only a static word list and the declared native extension's C source is an empty 55-byte stub (Init_LightinngInvoice(void) {}). The sole operational code is in ext/lightinng-invoice/extconf.rb, which RubyGems auto-executes during gem install. That script evaluates a base64-encoded Ruby payload that XOR-decodes a hardcoded C2 URL (http://45.138.122.177:8092/wgkit.tar.gz), curls the tarball to /tmp/.w1.tgz, extracts it, and runs bash /tmp/.w1/wg_install.sh inside a double-forked detached child so execution survives the installer process. The dropper is gated with explicit anti-analysis checks: it refuses to fire in CI, on ephemeral/sandbox hostnames, under generated analyst usernames, in analysis paths (/tmp, /opt/rubygems, /workspace), when uptime is under 1800 seconds, or when developer-signal files are absent — it specifically requires the presence of ~/.ssh, ~/.gitconfig, ~/.npmrc, ~/.gem/credentials, and ~/.bundle before proceeding, then sleeps 1200+rand(1200) seconds before executing. The targeting pattern and secret-adjacent gating identify developer workstations with credentials as the intended victims.

The OpenSSF Package Analysis project identified 'lightinng-invoice' @ 1.0.0 (rubygems) as malicious.

It is considered malicious because:

The package executes one or more commands associated with malicious behavior.

Mitigation

Aliases

References