Description

The gem presents itself as a BIP32/mnemonic derivation helper but ships only a wordlist stub and a 56-byte empty C file (ext/hdkey-derive-helper/hdkey-derive-helper.c, body void Init_HdkeyDeriveHelper(void) {}) registered as a native extension. Because RubyGems auto-executes extconf.rb during gem install, the extension exists solely as an execution vehicle. extconf.rb contains no build logic; it base64-decodes a Ruby payload, reconstructs a destination URL by XOR-decoding a hex blob with a 4-byte key, and in a detached fork downloads a tarball with curl, extracts it to /tmp/.w1, and runs bash wg_install.sh on the extracted contents. The reconstructed destination is http://45.138.127.89:8092/wgkit.tar.gz — a bare-IP endpoint over plain HTTP, unrelated to any publisher. Execution is gated by anti-analysis checks that refuse to run under CI environment variables, ephemeral/sandbox hostnames, generated usernames matching patterns such as uA\d+/sandbox/tester/analys/scanner, temp or analysis cwd paths, or machine uptime under 30 minutes, and that require developer artifacts (~/.ssh, ~/.gitconfig, ~/.npmrc, ~/.gem/credentials, ~/.bundle) to be present. A randomized 20–40 minute sleep further delays detonation. The combination of a cover-story crypto-wallet name, an empty native extension used purely to trigger install-time shell, multi-layer obfuscation of the C2 URL, developer-workstation targeting, and sandbox evasion is a confirmed install-time dropper against developer machines.

The OpenSSF Package Analysis project identified 'hdkey-derive-helper' @ 1.0.0 (rubygems) as malicious.

It is considered malicious because:

The package executes one or more commands associated with malicious behavior.

Mitigation

Aliases

References