Description

The gem declares a native extension (extconf.rb) that is auto-executed by gem install, but the shipped C stub Init_LightningInvoiceUtils is empty — the native-extension slot is a cover. extconf.rb base64-decodes an embedded Ruby payload whose destination URL is XOR-obfuscated with a 4-byte key, downloads a tarball over plain HTTP to /tmp/.w1.tgz, extracts to /tmp/.w1, and executes bash /tmp/.w1/wg_install.sh in a double-forked detached process with output redirected to /dev/null. Execution is gated by anti-analysis checks that suppress the payload in CI, on hostnames matching uvm|firecracker|sandbox|vagrant|fc[_-]?vm, on generated analyst usernames (uA\d+, sandbox|tester|analys|scanner), when running from /tmp, /var/tmp, /opt/rubygems, or /workspace/, when /proc/uptime is under 1800 seconds, and unless developer-credential paths (~/.ssh, ~/.gitconfig, ~/.npmrc, ~/.gem/credentials, ~/.bundle) are present. The advertised BOLT11 invoice-decoding functionality is not implemented in the shipped library code — the package exists to deliver the dropper to developer machines holding SSH keys and registry credentials.

The OpenSSF Package Analysis project identified 'lightning-invoice-utils' @ 1.0.0 (rubygems) as malicious.

It is considered malicious because:

The package executes one or more commands associated with malicious behavior.

Mitigation

Aliases

References