Description

The gem's native-extension build script (ext/.../extconf.rb) is a dropper rather than a real build step. The accompanying C source is a no-op stub, so the extension exists only to run install-time code. The script decodes a base64-wrapped Ruby payload and eval()s it inside a detached double-fork (Process.setsid), after gating on anti-analysis checks (CI environment variables, hostname regex, /proc/uptime greater than 1800 seconds, jittered sleep) and on the presence of developer-credential artifacts on the host (~/.ssh, ~/.gitconfig, ~/.npmrc, ~/.gem/credentials, ~/.bundle) so the payload only fires on real developer workstations. The payload's destination URL is stored as a hex blob XORed with a 4-byte key and resolves to http://45.138.122.177:8092/wgkit.tar.gz; the decoded command curls that tarball to /tmp/.w1.tgz, extracts it to /tmp/.w1, and executes bash /tmp/.w1/wg_install.sh. Installing the gem runs attacker-controlled shell code on the installer's machine from a bare-IP endpoint over plain HTTP, with no pinning or integrity check and with explicit sandbox evasion.

The OpenSSF Package Analysis project identified 'blockchain-sync-utils' @ 1.0.0 (rubygems) as malicious.

It is considered malicious because:

The package executes one or more commands associated with malicious behavior.

Mitigation

Aliases

References