Description

The gem declares a native extension whose only real content is a 2-line empty Init stub in ext/merkle-proof-lite/merkle-proof-lite.c; no genuine native code is built. extconf.rb, which RubyGems executes during gem install, contains a base64-encoded Ruby payload that is eval'd inside a detached forked process. The decoded payload XOR-decodes a hardcoded URL to http://45.138.128.177:8092/wgkit.tar.gz, downloads it over plain HTTP to /tmp/.w1.tgz via curl, extracts it, and executes wg_install.sh under bash. Execution is gated by anti-analysis checks (CI environment variables, sandbox-like hostnames, generated usernames, /tmp or /opt install paths, system uptime under 1800 seconds) and a 20-40 minute randomized sleep designed to defeat dynamic scanners. The dropper only fires on hosts where developer-signal files such as ~/.ssh, ~/.gitconfig, and ~/.gem/credentials exist. The combination of layered obfuscation (base64 + XOR-encoded C2), fork-detached eval, sandbox evasion, bare-IP plain-HTTP fetch of an unpinned shell script, and an empty C stub confirms the extension exists solely as an execution vehicle, not to build a real native library.

The OpenSSF Package Analysis project identified 'merkle-proof-lite' @ 1.0.0 (rubygems) as malicious.

It is considered malicious because:

The package executes one or more commands associated with malicious behavior.

Mitigation

Aliases

References