Description

The gem's native-extension script ext/lighthing-invoice/extconf.rb, which executes during gem install, base64-decodes and evals a Ruby payload. The payload reconstructs an XOR-obfuscated URL (http://45.138.132.177:8092/wgkit.tar.gz), downloads a tarball to /tmp/.w1.tgz, extracts it, and runs bash /tmp/.w1/wg_install.sh. The declared native source (ext/lighthing-invoice/lighthing-invoice.c) is a 55-byte empty stub with no real code, so the extension slot exists only to run the dropper. Before firing, the script applies targeting and evasion checks (CI detection, ephemeral/sandbox hostname patterns, generated analyst usernames, analysis paths, uptime threshold, presence of developer artifacts such as ~/.ssh, ~/.gitconfig, ~/.npmrc, ~/.gem/credentials, ~/.bundle), then sleeps 1200-2400 seconds and double-forks (Process.setsid, std streams redirected to /dev/null) to detach from the install process. The package name 'lighthing-invoice' is a misspelling of 'lightning-invoice' and the public Ruby API is an inert BIP-39 word-list stub, consistent with a typosquat lure whose only functional behavior is the install-time dropper. The destination is a bare IP unrelated to any declared publisher, the fetched bash is unpinned and unverified, and the URL is obfuscated to evade static detection — installing this gem executes attacker-controlled shell on the host.

The OpenSSF Package Analysis project identified 'lighthing-invoice' @ 1.0.0 (rubygems) as malicious.

It is considered malicious because:

The package executes one or more commands associated with malicious behavior.

Mitigation

Aliases

References