DependencyWatch.io
FeedSolutionsSubmitScan your lockfile
Feed
HighMalicious packagePublished 5 Oct 202625 packages · 25 versions

RubyGems Ethereum/crypto wgkit cluster - 25 gems drop `/tmp/.w1/wg_install.sh` from 45.138.*.*

Summary

OpenSSF/Amazon Inspector flagged 25 RubyGems packages posing as Ethereum/Bitcoin/Lightning crypto utilities on 2026-10-05. All v1.0.0; extconf.rb base64/XOR-decodes a Ruby payload, double-forks, sleeps 20-40 min, then downloads wgkit.tar.gz from 45.138.*.*:8089-8092 and runs /tmp/.w1/wg_install.sh. Fires only on dev hosts with SSH/git/gem creds.

typosquatcredential-theftinfostealerobfuscationcrypto-wallet-drain
Incident type
Malicious package. A package that was malicious from its first publish under its own name - a fake tool, a lure used in a social-engineering campaign, or a trojanised utility - rather than a copy of an existing name.
Detected by
OpenSSF malicious-packages · Amazon Inspector · GitHub Advisory Database
Also known as
wgkit.tar.gz RubyGems crypto cluster · 45.138.*.* RubyGems Ethereum typosquat burst
Ecosystems
RubyGems
Packages tracked
25

What happened

Between roughly 2026-10-05 09:00 and 22:00 UTC, the GitHub Advisory Database (via OpenSSF malicious-packages and Amazon Inspector`s IN-MAL feed) published 25 RubyGems malware advisories flagging a tightly-coherent operator-level typosquat / brand-lure wave in the Ethereum, Bitcoin, Lightning Network, and Web3 verticals.

Payload family

All 26 gems share an identical delivery pattern:

  1. The gem ships an ext/<name>/extconf.rb native-extension build file that gem install auto-executes.
  2. extconf.rb base64-decodes a Ruby payload with Base64.decode64 and runs it under eval.
  3. The payload double-forks a detached background process, applies sandbox-evasion gates (CI env, hostname regex uvm/firecracker/sandbox/vagrant, analysis-path prefix /tmp|/opt/rubygems|/workspace|/private/var/tmp, developer-artefact presence ~/.ssh|~/.gitconfig|~/.npmrc|~/.gem/credentials|~/.bundle, uptime > 1800 s), and jitters 20-40 minutes before activating.
  4. The payload reconstructs a URL by XOR-decoding a 4-byte-keyed hex blob, downloads wgkit.tar.gz over plain HTTP, extracts to /tmp/.w1/, and runs bash /tmp/.w1/wg_install.sh.
  5. A subset (btc-wallet-tools, crypto-mnemonic-tools, web3-eth-utils, eth-address-utils, eth-keystore-utils) instead (or additionally) opens a TCP reverse shell to the C2 directly via IO.popen with socket bridging to /bin/sh.

The shipped C extensions are empty stubs (etheremu.rb ships only a truncated BIP39 wordlist with no Ethereum code; tx-broadcast-utils has no broadcast code; cryoto-toolbox has no crypto routines). The entire package exists to deliver the dropper.

C2 infrastructure

All C2 endpoints are on the Russian/Dutch-hosted 45.138.0.0/16 superblock across several /24s:

HostPortObserved in
45.138.12.1778089bitcoin-rpc-lite, web3-eth-utils (reverse shell)
45.138.12.1778090btc-wallet-tools, crypto-mnemonic-tools, eth-address-utils (reverse shell)
45.138.17.70809tx-broadcast-utils
45.138.17.1778092tron-rb
45.138.122.1778092blockchain-sync-utils, kecack
45.138.127.778092crypto-key-utils
45.138.172.1778092electrum-protocol-lite

All of them serve the same wgkit.tar.gz → /tmp/.w1/wg_install.sh installer where the operator stages whatever current second-stage is desired.

Package inventory and source SHA-256 (all v1.0.0)

PackageGHSASHA-256 of malicious release
bitcoin-rpc-liteGHSA-xw7g-6j29-52jp4567a3469d6774fbe9be233375145274adf41f8e7a20521724a9a15606351044
blockchain-sync-utilsGHSA-fp5m-6565-9wg5(dropper to 45.138.122.177:8092)
btc-wallet-toolsGHSA-65q2-732f-r3gg06838084180f1f087704c390cedde5a8d3610f4895356632f938139faef7d5e3
electrum-protocol-liteGHSA-8cm7-334g-4377668c7bcfd51cfcc2efda2d772dc087067883a214357361a960f6db8e2a9ca1e8
cryoto-toolboxGHSA-f8ww-m74w-j9mq3fcf75a196193219b146e937b6d9a7cf8937df152658a2d7b7b8905605c9f8a6
crypto-key-utilsGHSA-9vq6-8jf2-mh9q559eb6e590366fcb8968de4964d8eb9d61ad6149a1ce1d4696ff4f64bff1a214
etheremu.rbGHSA-r55r-pjq3-j9f4a82ac5d3f021ab23f4f461181f4150c12d672ef421b6f80c10dd8a307178442e
crypti-toolboxGHSA-pv2w-f5fh-p8xw5ec4d5d5915335d90b2f18b45b050936fa5d2db9d176d7d081bd8c292c7c6795
ethereum-tx-helperGHSA-gm98-33j2-hm68e870b276b866298ef1e57e1ceff7ef4e253cb43055d0163572e25646be7b8791
crypto-mnemonic-toolsGHSA-q7p5-w99x-qqcw20550e421f034d2bf7c4ca653a79a2558f3d84a49a54566e874d92cc80557469
crylto-toolboxGHSA-gxwc-r8hg-vg7r4362469cec139567ebe3c986d7f2eca2dda837ecff87373d14d9cfbedf81e6b0
coinmarket-utilsGHSA-f63h-97qr-7h9q7ace1863ec858e5931ba2848276c14fb050fff204b2fbea82e2f64ae3f9a0ffc
etherdum.rbGHSA-f6c2-r38w-6v9xa27b2952de0064d1745d45f18fc1ab974e48cfe185b8f41e90447265be1a880f
kecackGHSA-fj4h-hgwh-qmc6f17f86c78cebe16698b84a8ab5a9b87865c63a890588c23fbe1d2638c4501647
ligbtning-invoiceGHSA-vv4j-hg36-54f886fdee6169e308a4849aae46edf725272a04cc0fe706f18006dcde8f54f86e2a
web3-eth-utilsGHSA-847r-2824-c2jx248aba9be7a8bfbd125b43640f1c52007358e34078b3bfec5430933c996b8666
eth-keystore-utilsGHSA-3chv-pqgw-55f8cd660255e3a3483ed89e81f30c696390f8b182a891f8f1fb7e4c1cbb3b52eb32
eth-address-utilsGHSA-cg29-22qj-86m48ed9d372d4fc694697be41c22e7c4d02d873e53e16bde2336069787b7b961ce2
lighthing-invoiceGHSA-j2pr-fmc4-v7mw206884c57f9427c6952744828fa53861634d5451b97ba86885c701ee47ef5012
kecckaGHSA-9c95-4459-6pcwe4f005ef5a4a20f9aadcdd2c6e78e6d68bb52765b2f5fac2abee6abd7dd261c5
hdkey-derive-helperGHSA-q82p-2pwq-fvp404f5409730ece37713b6a8d3afddcce30744e213b80759f7ae89478731b0264a
merkle-proof-liteGHSA-f56x-cg82-pmmp566447bbe57c81d3ad0e7f640951edd848b5a843c8b423ca370d96938d803cba
tron-rbGHSA-pfxv-45h9-p87wa483b2d8f8273b5dca3a95d449d762cdfe9d79e8aea485cb89673c469e4cda6f
tx-broadcast-utilsGHSA-m56c-f68h-prj560efdf159c3ce8550c985b3f19cbe72f2bfcae0266cb63fb8c0dd458b56b9901
web3-sign-helperGHSA-5878-j847-4p4padeb83bd6e9fada6d55dfe140c32a5ae29d4b3331fb888643ebe064e6d57fc23

All affected at exactly version 1.0.0. No patched versions exist for any of them - the entire package is the malware.

Attribution and classification

No named-actor attribution. The targeting vertical (crypto / Web3 / Ethereum / Bitcoin / Lightning / TRON developers), the single-C2-family infrastructure (45.138.*.*), the uniform wgkit.tar.gz → /tmp/.w1/wg_install.sh installer, and the uniform anti-analysis / developer-artefact gates argue strongly for one operator rather than a loose group.

Classified malicious-package (the dominant pattern - most names are brand-adjacent lures built fresh for this wave rather than strict single-character typosquats), severity high (confirmed install-time RCE and reverse-shell payload, but reach is limited to whoever installs the lure - not a known-popular gem hijack).

Discovery

OpenSSF malicious-packages, Amazon Inspector. All 25 advisories published to GitHub Advisory Database on 2026-10-05.

Affected packages (25)

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once - it runs in your browser and nothing is uploaded.

Impact

  • All 25 gems share one operator infrastructure: wgkit.tar.gz dropper over plain HTTP from the 45.138.*.* subnet (45.138.12.177:8089, 45.138.12.177:8090, 45.138.17.70:809, 45.138.17.177:8092, 45.138.122.177:8092, 45.138.127.77:8092, 45.138.172.177:8092). After extracting to /tmp/.w1/, the installer runs bash /tmp/.w1/wg_install.sh with the installer user`s privileges
  • Install-time Ruby eval() of a base64-decoded payload shipped inside ext/<name>/extconf.rb masquerading as a native-extension build file. The real extensions are empty C stubs; the "build" step is the entire malware
  • Sandbox-evasion gates skip execution under CI (CI, GITHUB_ACTIONS, BUILDKITE, GITLAB_CI), under analysis path prefixes (/tmp, /opt/rubygems, /workspace, /private/var/tmp), under hostnames matching uvm, firecracker, sandbox, vagrant, and when developer artefact signals (~/.ssh, ~/.gitconfig, ~/.npmrc, ~/.gem/credentials, ~/.bundle) are absent. Jittered 20-40 min sleep further defeats short-window sandboxes
  • A subset (btc-wallet-tools, crypto-mnemonic-tools, web3-eth-utils, eth-address-utils, eth-keystore-utils) opens a direct TCP reverse shell to 45.138.12.177:8089/:8090 instead of (or in addition to) the wgkit.tar.gz fetch; the rest fetch and execute the shell script
  • Target profile is cryptocurrency / Web3 developer workstations: SSH keys, GitHub PATs, RubyGems API keys, ~/.ethereum/keystore, MetaMask browser profiles, hardware-wallet companion configs, and any crypto exchange CLI credentials on the host are reachable once wg_install.sh runs
  • Package names: 10 are deliberate single-char typosquats of real crypto gems (crypti-toolbox/crylto-toolbox/cryoto-toolbox → crypto-toolbox; keccka/kecack → keccak; lighthing-invoice/ligbtning-invoice → lightning-invoice; etherdum.rb/etheremu.rb → ethereum.rb; plus tron-rb for the TRON vertical); 15 are brand-adjacent lures built from Ethereum / Bitcoin / Web3 ecosystem terms (eth-keystore-utils, eth-address-utils, web3-eth-utils, web3-sign-helper, crypto-key-utils, crypto-mnemonic-tools, hdkey-derive-helper, merkle-proof-lite, btc-wallet-tools, bitcoin-rpc-lite, electrum-protocol-lite, blockchain-sync-utils, coinmarket-utils, ethereum-tx-helper, tx-broadcast-utils)

What to do

  1. 1grep -nE "(bitcoin-rpc-lite|blockchain-sync-utils|btc-wallet-tools|electrum-protocol-lite|cryoto-toolbox|crypto-key-utils|etheremu\.rb|crypti-toolbox|ethereum-tx-helper|crypto-mnemonic-tools|crylto-toolbox|coinmarket-utils|etherdum\.rb|kecack|ligbtning-invoice|web3-eth-utils|eth-keystore-utils|eth-address-utils|lighthing-invoice|keccka|hdkey-derive-helper|merkle-proof-lite|tron-rb|tx-broadcast-utils|web3-sign-helper|cryoto-toolbox)" Gemfile Gemfile.lock gemspec across every repo. On any hit: gem uninstall <name>, delete Gemfile.lock, delete ~/.gem/credentials tokens, rebuild from scratch
  2. 2Host-level hunt on any machine that ran gem install or bundle install against the above since 2026-10-05: look for a directory /tmp/.w1/ (any user), a file /tmp/.w1.tgz, a shell bash /tmp/.w1/wg_install.sh in bash history or process audit logs, outbound HTTP to 45.138.12.177, 45.138.17.70, 45.138.17.177, 45.138.122.177, 45.138.127.77, 45.138.172.177 on ports 809, 8089, 8090, 8092. Any single hit means image the host - the dropper runs as the installing user and the second-stage is attacker-controlled, so persistence is anything the script dropped
  3. 3Rotate on any confirmed hit: SSH keys (~/.ssh/*), Git tokens (~/.gitconfig, ~/.config/gh, GitHub/GitLab PATs), RubyGems API key (~/.gem/credentials; log in to rubygems.org, revoke old key, issue new one), npm authToken (~/.npmrc), Bundler config (~/.bundle/config), any ~/.ethereum/keystore/* (treat seed phrases AS exposed - rotate the wallets, not just the config), hardware-wallet companion app secrets, exchange CLI credentials. On a developer who runs gem install as a privileged user, assume ~/.aws/credentials and ~/.config/gcloud are reachable too and rotate those
  4. 4Egress blocklist additions for CI, build hosts, and corporate developer egress proxies: deny outbound TCP to 45.138.12.177, 45.138.17.70, 45.138.17.177, 45.138.122.177, 45.138.127.77, 45.138.172.177 (whole /24s if your proxy supports it: 45.138.12.0/24, 45.138.17.0/24, 45.138.122.0/24, 45.138.127.0/24, 45.138.172.0/24). Deny outbound HTTP (not HTTPS - the dropper is plain HTTP) by default from CI; whitelist specific HTTPS mirrors instead
  5. 5Developer education: the real crypto gems are crypto-toolbox, keccak, lightning-invoice, ethereum.rb, eth (not eth-*), web3 (not web3-eth-* as a bare gem), and the official hardware-wallet SDKs. Any gem that advertises Bitcoin/Ethereum/Web3 functionality at 1.0.0 with no release history and extconf.rb under ext/<name>/ deserves a tarball inspection in a sandbox before gem install

References

Back to feedSubmit a correction
rubygems-2026-10-05-eth-crypto-wgkit-cluster