# RubyGems Ethereum/crypto wgkit cluster - 25 gems drop `/tmp/.w1/wg_install.sh` from 45.138.*.*

> OpenSSF/Amazon Inspector flagged 25 RubyGems packages posing as Ethereum/Bitcoin/Lightning crypto utilities on 2026-10-05. All v`1.0.0`; `extconf.rb` base64/XOR-decodes a Ruby payload, double-forks, sleeps 20-40 min, then downloads `wgkit.tar.gz` from `45.138.*.*:8089-8092` and runs `/tmp/.w1/wg_install.sh`. Fires only on dev hosts with SSH/git/gem creds.

- Published: 2026-10-05
- Severity: high
- Kind: Malicious package - A package that was malicious from its first publish under its own name - a fake tool, a lure used in a social-engineering campaign, or a trojanised utility - rather than a copy of an existing name.
- Ecosystems: RubyGems
- Scope: 25 packages, 25 compromised versions
- Tags: typosquat, credential-theft, infostealer, obfuscation, crypto-wallet-drain
- Also known as: wgkit.tar.gz RubyGems crypto cluster, 45.138.*.* RubyGems Ethereum typosquat burst
- Detected by: OpenSSF malicious-packages, Amazon Inspector, GitHub Advisory Database
- Incident ID: rubygems-2026-10-05-eth-crypto-wgkit-cluster

## Affected packages (25)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [bitcoin-rpc-lite](https://dependencywatch.io/package/rubygems/bitcoin-rpc-lite) | RubyGems | 1.0.0 |
| [blockchain-sync-utils](https://dependencywatch.io/package/rubygems/blockchain-sync-utils) | RubyGems | 1.0.0 |
| [btc-wallet-tools](https://dependencywatch.io/package/rubygems/btc-wallet-tools) | RubyGems | 1.0.0 |
| [coinmarket-utils](https://dependencywatch.io/package/rubygems/coinmarket-utils) | RubyGems | 1.0.0 |
| [crylto-toolbox](https://dependencywatch.io/package/rubygems/crylto-toolbox) | RubyGems | 1.0.0 |
| [cryoto-toolbox](https://dependencywatch.io/package/rubygems/cryoto-toolbox) | RubyGems | 1.0.0 |
| [crypti-toolbox](https://dependencywatch.io/package/rubygems/crypti-toolbox) | RubyGems | 1.0.0 |
| [crypto-key-utils](https://dependencywatch.io/package/rubygems/crypto-key-utils) | RubyGems | 1.0.0 |
| [crypto-mnemonic-tools](https://dependencywatch.io/package/rubygems/crypto-mnemonic-tools) | RubyGems | 1.0.0 |
| [electrum-protocol-lite](https://dependencywatch.io/package/rubygems/electrum-protocol-lite) | RubyGems | 1.0.0 |
| [eth-address-utils](https://dependencywatch.io/package/rubygems/eth-address-utils) | RubyGems | 1.0.0 |
| [eth-keystore-utils](https://dependencywatch.io/package/rubygems/eth-keystore-utils) | RubyGems | 1.0.0 |
| [etherdum.rb](https://dependencywatch.io/package/rubygems/etherdum.rb) | RubyGems | 1.0.0 |
| [etheremu.rb](https://dependencywatch.io/package/rubygems/etheremu.rb) | RubyGems | 1.0.0 |
| [ethereum-tx-helper](https://dependencywatch.io/package/rubygems/ethereum-tx-helper) | RubyGems | 1.0.0 |
| [hdkey-derive-helper](https://dependencywatch.io/package/rubygems/hdkey-derive-helper) | RubyGems | 1.0.0 |
| [kecack](https://dependencywatch.io/package/rubygems/kecack) | RubyGems | 1.0.0 |
| [keccka](https://dependencywatch.io/package/rubygems/keccka) | RubyGems | 1.0.0 |
| [ligbtning-invoice](https://dependencywatch.io/package/rubygems/ligbtning-invoice) | RubyGems | 1.0.0 |
| [lighthing-invoice](https://dependencywatch.io/package/rubygems/lighthing-invoice) | RubyGems | 1.0.0 |
| [merkle-proof-lite](https://dependencywatch.io/package/rubygems/merkle-proof-lite) | RubyGems | 1.0.0 |
| [tron-rb](https://dependencywatch.io/package/rubygems/tron-rb) | RubyGems | 1.0.0 |
| [tx-broadcast-utils](https://dependencywatch.io/package/rubygems/tx-broadcast-utils) | RubyGems | 1.0.0 |
| [web3-eth-utils](https://dependencywatch.io/package/rubygems/web3-eth-utils) | RubyGems | 1.0.0 |
| [web3-sign-helper](https://dependencywatch.io/package/rubygems/web3-sign-helper) | RubyGems | 1.0.0 |

## What happened

Between roughly 2026-10-05 09:00 and 22:00 UTC, the GitHub Advisory Database (via OpenSSF `malicious-packages` and Amazon Inspector`s IN-MAL feed) published 25 RubyGems malware advisories flagging a tightly-coherent operator-level typosquat / brand-lure wave in the Ethereum, Bitcoin, Lightning Network, and Web3 verticals.

## Payload family

All 26 gems share an identical delivery pattern:

1. The gem ships an `ext/<name>/extconf.rb` native-extension build file that `gem install` auto-executes.
2. `extconf.rb` base64-decodes a Ruby payload with `Base64.decode64` and runs it under `eval`.
3. The payload double-forks a detached background process, applies sandbox-evasion gates (CI env, hostname regex `uvm/firecracker/sandbox/vagrant`, analysis-path prefix `/tmp|/opt/rubygems|/workspace|/private/var/tmp`, developer-artefact presence `~/.ssh|~/.gitconfig|~/.npmrc|~/.gem/credentials|~/.bundle`, uptime > 1800 s), and jitters 20-40 minutes before activating.
4. The payload reconstructs a URL by XOR-decoding a 4-byte-keyed hex blob, downloads `wgkit.tar.gz` over plain HTTP, extracts to `/tmp/.w1/`, and runs `bash /tmp/.w1/wg_install.sh`.
5. A subset (`btc-wallet-tools`, `crypto-mnemonic-tools`, `web3-eth-utils`, `eth-address-utils`, `eth-keystore-utils`) instead (or additionally) opens a TCP reverse shell to the C2 directly via `IO.popen` with socket bridging to `/bin/sh`.

The shipped C extensions are empty stubs (`etheremu.rb` ships only a truncated BIP39 wordlist with no Ethereum code; `tx-broadcast-utils` has no broadcast code; `cryoto-toolbox` has no crypto routines). The entire package exists to deliver the dropper.

## C2 infrastructure

All C2 endpoints are on the Russian/Dutch-hosted `45.138.0.0/16` superblock across several `/24`s:

| Host | Port | Observed in |
|---|---|---|
| `45.138.12.177` | 8089 | `bitcoin-rpc-lite`, `web3-eth-utils` (reverse shell) |
| `45.138.12.177` | 8090 | `btc-wallet-tools`, `crypto-mnemonic-tools`, `eth-address-utils` (reverse shell) |
| `45.138.17.70` | 809 | `tx-broadcast-utils` |
| `45.138.17.177` | 8092 | `tron-rb` |
| `45.138.122.177` | 8092 | `blockchain-sync-utils`, `kecack` |
| `45.138.127.77` | 8092 | `crypto-key-utils` |
| `45.138.172.177` | 8092 | `electrum-protocol-lite` |

All of them serve the same `wgkit.tar.gz` → `/tmp/.w1/wg_install.sh` installer where the operator stages whatever current second-stage is desired.

## Package inventory and source SHA-256 (all v1.0.0)

| Package | GHSA | SHA-256 of malicious release |
|---|---|---|
| `bitcoin-rpc-lite` | GHSA-xw7g-6j29-52jp | `4567a3469d6774fbe9be233375145274adf41f8e7a20521724a9a15606351044` |
| `blockchain-sync-utils` | GHSA-fp5m-6565-9wg5 | (dropper to `45.138.122.177:8092`) |
| `btc-wallet-tools` | GHSA-65q2-732f-r3gg | `06838084180f1f087704c390cedde5a8d3610f4895356632f938139faef7d5e3` |
| `electrum-protocol-lite` | GHSA-8cm7-334g-4377 | `668c7bcfd51cfcc2efda2d772dc087067883a214357361a960f6db8e2a9ca1e8` |
| `cryoto-toolbox` | GHSA-f8ww-m74w-j9mq | `3fcf75a196193219b146e937b6d9a7cf8937df152658a2d7b7b8905605c9f8a6` |
| `crypto-key-utils` | GHSA-9vq6-8jf2-mh9q | `559eb6e590366fcb8968de4964d8eb9d61ad6149a1ce1d4696ff4f64bff1a214` |
| `etheremu.rb` | GHSA-r55r-pjq3-j9f4 | `a82ac5d3f021ab23f4f461181f4150c12d672ef421b6f80c10dd8a307178442e` |
| `crypti-toolbox` | GHSA-pv2w-f5fh-p8xw | `5ec4d5d5915335d90b2f18b45b050936fa5d2db9d176d7d081bd8c292c7c6795` |
| `ethereum-tx-helper` | GHSA-gm98-33j2-hm68 | `e870b276b866298ef1e57e1ceff7ef4e253cb43055d0163572e25646be7b8791` |
| `crypto-mnemonic-tools` | GHSA-q7p5-w99x-qqcw | `20550e421f034d2bf7c4ca653a79a2558f3d84a49a54566e874d92cc80557469` |
| `crylto-toolbox` | GHSA-gxwc-r8hg-vg7r | `4362469cec139567ebe3c986d7f2eca2dda837ecff87373d14d9cfbedf81e6b0` |
| `coinmarket-utils` | GHSA-f63h-97qr-7h9q | `7ace1863ec858e5931ba2848276c14fb050fff204b2fbea82e2f64ae3f9a0ffc` |
| `etherdum.rb` | GHSA-f6c2-r38w-6v9x | `a27b2952de0064d1745d45f18fc1ab974e48cfe185b8f41e90447265be1a880f` |
| `kecack` | GHSA-fj4h-hgwh-qmc6 | `f17f86c78cebe16698b84a8ab5a9b87865c63a890588c23fbe1d2638c4501647` |
| `ligbtning-invoice` | GHSA-vv4j-hg36-54f8 | `86fdee6169e308a4849aae46edf725272a04cc0fe706f18006dcde8f54f86e2a` |
| `web3-eth-utils` | GHSA-847r-2824-c2jx | `248aba9be7a8bfbd125b43640f1c52007358e34078b3bfec5430933c996b8666` |
| `eth-keystore-utils` | GHSA-3chv-pqgw-55f8 | `cd660255e3a3483ed89e81f30c696390f8b182a891f8f1fb7e4c1cbb3b52eb32` |
| `eth-address-utils` | GHSA-cg29-22qj-86m4 | `8ed9d372d4fc694697be41c22e7c4d02d873e53e16bde2336069787b7b961ce2` |
| `lighthing-invoice` | GHSA-j2pr-fmc4-v7mw | `206884c57f9427c6952744828fa53861634d5451b97ba86885c701ee47ef5012` |
| `keccka` | GHSA-9c95-4459-6pcw | `e4f005ef5a4a20f9aadcdd2c6e78e6d68bb52765b2f5fac2abee6abd7dd261c5` |
| `hdkey-derive-helper` | GHSA-q82p-2pwq-fvp4 | `04f5409730ece37713b6a8d3afddcce30744e213b80759f7ae89478731b0264a` |
| `merkle-proof-lite` | GHSA-f56x-cg82-pmmp | `566447bbe57c81d3ad0e7f640951edd848b5a843c8b423ca370d96938d803cba` |
| `tron-rb` | GHSA-pfxv-45h9-p87w | `a483b2d8f8273b5dca3a95d449d762cdfe9d79e8aea485cb89673c469e4cda6f` |
| `tx-broadcast-utils` | GHSA-m56c-f68h-prj5 | `60efdf159c3ce8550c985b3f19cbe72f2bfcae0266cb63fb8c0dd458b56b9901` |
| `web3-sign-helper` | GHSA-5878-j847-4p4p | `adeb83bd6e9fada6d55dfe140c32a5ae29d4b3331fb888643ebe064e6d57fc23` |

All affected at exactly version `1.0.0`. No patched versions exist for any of them - the entire package is the malware.

## Attribution and classification

No named-actor attribution. The targeting vertical (crypto / Web3 / Ethereum / Bitcoin / Lightning / TRON developers), the single-C2-family infrastructure (`45.138.*.*`), the uniform `wgkit.tar.gz` → `/tmp/.w1/wg_install.sh` installer, and the uniform anti-analysis / developer-artefact gates argue strongly for one operator rather than a loose group.

Classified `malicious-package` (the dominant pattern - most names are brand-adjacent lures built fresh for this wave rather than strict single-character typosquats), severity `high` (confirmed install-time RCE and reverse-shell payload, but reach is limited to whoever installs the lure - not a known-popular gem hijack).

## Discovery

`OpenSSF malicious-packages`, `Amazon Inspector`. All 25 advisories published to GitHub Advisory Database on 2026-10-05.

## Impact

- All 25 gems share one operator infrastructure: `wgkit.tar.gz` dropper over plain HTTP from the `45.138.*.*` subnet (`45.138.12.177:8089`, `45.138.12.177:8090`, `45.138.17.70:809`, `45.138.17.177:8092`, `45.138.122.177:8092`, `45.138.127.77:8092`, `45.138.172.177:8092`). After extracting to `/tmp/.w1/`, the installer runs `bash /tmp/.w1/wg_install.sh` with the installer user`s privileges
- Install-time Ruby `eval()` of a base64-decoded payload shipped inside `ext/<name>/extconf.rb` masquerading as a native-extension build file. The real extensions are empty C stubs; the "build" step is the entire malware
- Sandbox-evasion gates skip execution under CI (`CI`, `GITHUB_ACTIONS`, `BUILDKITE`, `GITLAB_CI`), under analysis path prefixes (`/tmp`, `/opt/rubygems`, `/workspace`, `/private/var/tmp`), under hostnames matching `uvm`, `firecracker`, `sandbox`, `vagrant`, and when developer artefact signals (`~/.ssh`, `~/.gitconfig`, `~/.npmrc`, `~/.gem/credentials`, `~/.bundle`) are absent. Jittered 20-40 min sleep further defeats short-window sandboxes
- A subset (`btc-wallet-tools`, `crypto-mnemonic-tools`, `web3-eth-utils`, `eth-address-utils`, `eth-keystore-utils`) opens a direct TCP reverse shell to `45.138.12.177:8089`/`:8090` instead of (or in addition to) the `wgkit.tar.gz` fetch; the rest fetch and execute the shell script
- Target profile is cryptocurrency / Web3 developer workstations: SSH keys, GitHub PATs, RubyGems API keys, `~/.ethereum/keystore`, MetaMask browser profiles, hardware-wallet companion configs, and any crypto exchange CLI credentials on the host are reachable once `wg_install.sh` runs
- Package names: 10 are deliberate single-char typosquats of real crypto gems (`crypti-toolbox`/`crylto-toolbox`/`cryoto-toolbox` → `crypto-toolbox`; `keccka`/`kecack` → `keccak`; `lighthing-invoice`/`ligbtning-invoice` → `lightning-invoice`; `etherdum.rb`/`etheremu.rb` → `ethereum.rb`; plus `tron-rb` for the TRON vertical); 15 are brand-adjacent lures built from Ethereum / Bitcoin / Web3 ecosystem terms (`eth-keystore-utils`, `eth-address-utils`, `web3-eth-utils`, `web3-sign-helper`, `crypto-key-utils`, `crypto-mnemonic-tools`, `hdkey-derive-helper`, `merkle-proof-lite`, `btc-wallet-tools`, `bitcoin-rpc-lite`, `electrum-protocol-lite`, `blockchain-sync-utils`, `coinmarket-utils`, `ethereum-tx-helper`, `tx-broadcast-utils`)

## What to do

1. `grep -nE "(bitcoin-rpc-lite|blockchain-sync-utils|btc-wallet-tools|electrum-protocol-lite|cryoto-toolbox|crypto-key-utils|etheremu\.rb|crypti-toolbox|ethereum-tx-helper|crypto-mnemonic-tools|crylto-toolbox|coinmarket-utils|etherdum\.rb|kecack|ligbtning-invoice|web3-eth-utils|eth-keystore-utils|eth-address-utils|lighthing-invoice|keccka|hdkey-derive-helper|merkle-proof-lite|tron-rb|tx-broadcast-utils|web3-sign-helper|cryoto-toolbox)" Gemfile Gemfile.lock gemspec` across every repo. On any hit: `gem uninstall <name>`, delete `Gemfile.lock`, delete `~/.gem/credentials` tokens, rebuild from scratch
2. **Host-level hunt** on any machine that ran `gem install` or `bundle install` against the above since 2026-10-05: look for a directory `/tmp/.w1/` (any user), a file `/tmp/.w1.tgz`, a shell `bash /tmp/.w1/wg_install.sh` in bash history or process audit logs, outbound HTTP to `45.138.12.177`, `45.138.17.70`, `45.138.17.177`, `45.138.122.177`, `45.138.127.77`, `45.138.172.177` on ports 809, 8089, 8090, 8092. **Any single hit means image the host** - the dropper runs as the installing user and the second-stage is attacker-controlled, so persistence is anything the script dropped
3. Rotate on any confirmed hit: SSH keys (`~/.ssh/*`), Git tokens (`~/.gitconfig`, `~/.config/gh`, GitHub/GitLab PATs), RubyGems API key (`~/.gem/credentials`; log in to rubygems.org, revoke old key, issue new one), npm authToken (`~/.npmrc`), Bundler config (`~/.bundle/config`), any `~/.ethereum/keystore/*` (treat seed phrases AS exposed - rotate the wallets, not just the config), hardware-wallet companion app secrets, exchange CLI credentials. On a developer who runs `gem install` as a privileged user, assume `~/.aws/credentials` and `~/.config/gcloud` are reachable too and rotate those
4. **Egress blocklist additions** for CI, build hosts, and corporate developer egress proxies: deny outbound TCP to `45.138.12.177`, `45.138.17.70`, `45.138.17.177`, `45.138.122.177`, `45.138.127.77`, `45.138.172.177` (whole `/24`s if your proxy supports it: `45.138.12.0/24`, `45.138.17.0/24`, `45.138.122.0/24`, `45.138.127.0/24`, `45.138.172.0/24`). Deny outbound HTTP (not HTTPS - the dropper is plain HTTP) by default from CI; whitelist specific HTTPS mirrors instead
5. **Developer education**: the real crypto gems are `crypto-toolbox`, `keccak`, `lightning-invoice`, `ethereum.rb`, `eth` (not `eth-*`), `web3` (not `web3-eth-*` as a bare gem), and the official hardware-wallet SDKs. Any gem that advertises Bitcoin/Ethereum/Web3 functionality at `1.0.0` with no release history and `extconf.rb` under `ext/<name>/` deserves a tarball inspection in a sandbox before `gem install`

## References

- [GitHub Advisory Database - recent RubyGems malware advisories](https://github.com/advisories?query=type%3Amalware+ecosystem%3Arubygems&sort=published-desc) - GitHub
- [GHSA-xw7g-6j29-52jp - rubygems bitcoin-rpc-lite](https://github.com/advisories/GHSA-xw7g-6j29-52jp) - GitHub
- [GHSA-fp5m-6565-9wg5 - rubygems blockchain-sync-utils](https://github.com/advisories/GHSA-fp5m-6565-9wg5) - GitHub
- [GHSA-65q2-732f-r3gg - rubygems btc-wallet-tools](https://github.com/advisories/GHSA-65q2-732f-r3gg) - GitHub
- [GHSA-8cm7-334g-4377 - rubygems electrum-protocol-lite](https://github.com/advisories/GHSA-8cm7-334g-4377) - GitHub
- [GHSA-f8ww-m74w-j9mq - rubygems cryoto-toolbox (typosquat crypto-toolbox)](https://github.com/advisories/GHSA-f8ww-m74w-j9mq) - GitHub
- [GHSA-9vq6-8jf2-mh9q - rubygems crypto-key-utils](https://github.com/advisories/GHSA-9vq6-8jf2-mh9q) - GitHub
- [GHSA-r55r-pjq3-j9f4 - rubygems etheremu.rb (typosquat ethereum.rb)](https://github.com/advisories/GHSA-r55r-pjq3-j9f4) - GitHub
- [GHSA-pv2w-f5fh-p8xw - rubygems crypti-toolbox (typosquat crypto-toolbox)](https://github.com/advisories/GHSA-pv2w-f5fh-p8xw) - GitHub
- [GHSA-gm98-33j2-hm68 - rubygems ethereum-tx-helper](https://github.com/advisories/GHSA-gm98-33j2-hm68) - GitHub
- [GHSA-q7p5-w99x-qqcw - rubygems crypto-mnemonic-tools](https://github.com/advisories/GHSA-q7p5-w99x-qqcw) - GitHub
- [GHSA-gxwc-r8hg-vg7r - rubygems crylto-toolbox (typosquat crypto-toolbox)](https://github.com/advisories/GHSA-gxwc-r8hg-vg7r) - GitHub
- [GHSA-f63h-97qr-7h9q - rubygems coinmarket-utils](https://github.com/advisories/GHSA-f63h-97qr-7h9q) - GitHub
- [GHSA-f6c2-r38w-6v9x - rubygems etherdum.rb (typosquat ethereum.rb)](https://github.com/advisories/GHSA-f6c2-r38w-6v9x) - GitHub
- [GHSA-fj4h-hgwh-qmc6 - rubygems kecack (typosquat keccak)](https://github.com/advisories/GHSA-fj4h-hgwh-qmc6) - GitHub
- [GHSA-vv4j-hg36-54f8 - rubygems ligbtning-invoice (typosquat lightning-invoice)](https://github.com/advisories/GHSA-vv4j-hg36-54f8) - GitHub
- [GHSA-847r-2824-c2jx - rubygems web3-eth-utils](https://github.com/advisories/GHSA-847r-2824-c2jx) - GitHub
- [GHSA-3chv-pqgw-55f8 - rubygems eth-keystore-utils](https://github.com/advisories/GHSA-3chv-pqgw-55f8) - GitHub
- [GHSA-cg29-22qj-86m4 - rubygems eth-address-utils](https://github.com/advisories/GHSA-cg29-22qj-86m4) - GitHub
- [GHSA-j2pr-fmc4-v7mw - rubygems lighthing-invoice (typosquat lightning-invoice)](https://github.com/advisories/GHSA-j2pr-fmc4-v7mw) - GitHub
- [GHSA-9c95-4459-6pcw - rubygems keccka (typosquat keccak)](https://github.com/advisories/GHSA-9c95-4459-6pcw) - GitHub
- [GHSA-q82p-2pwq-fvp4 - rubygems hdkey-derive-helper](https://github.com/advisories/GHSA-q82p-2pwq-fvp4) - GitHub
- [GHSA-f56x-cg82-pmmp - rubygems merkle-proof-lite](https://github.com/advisories/GHSA-f56x-cg82-pmmp) - GitHub
- [GHSA-pfxv-45h9-p87w - rubygems tron-rb](https://github.com/advisories/GHSA-pfxv-45h9-p87w) - GitHub
- [GHSA-m56c-f68h-prj5 - rubygems tx-broadcast-utils](https://github.com/advisories/GHSA-m56c-f68h-prj5) - GitHub
- [GHSA-5878-j847-4p4p - rubygems web3-sign-helper](https://github.com/advisories/GHSA-5878-j847-4p4p) - GitHub

---

Canonical page: https://dependencywatch.io/incident/rubygems-2026-10-05-eth-crypto-wgkit-cluster
Markdown version: https://dependencywatch.io/incident/rubygems-2026-10-05-eth-crypto-wgkit-cluster.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).