MAL-2026-17580

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (1fe852f0d3458d12270208daca66a3f83046929fcf8434d556261f89d578c06a)

The gem's ext/base58-check-helper/extconf.rb runs during gem install and, before invoking create_makefile, performs anti-analysis gating: it skips execution when CI environment variables are present, when the hostname looks ephemeral, when the username looks synthetic, when the working path matches /tmp, /opt/rubygems, or /workspace, when machine uptime is under 1800 seconds, or when common developer dotfiles are absent. When those checks indicate a real developer workstation (presence of ~/.ssh, ~/.gitconfig, ~/.npmrc, ~/.gem/credentials, or ~/.bundle), it base64-decodes an embedded Ruby payload and eval's it inside a double-forked, Process.setsid-daemonized child. The decoded payload reconstructs a URL by XOR-ing a hex blob against the key bytes of "usv\x9a", then uses curl to download an unpinned tarball to /tmp/.w1.tgz, extracts it to /tmp/.w1, and executes bash /tmp/.w1/wg_install.sh. The native source accompanying the extension is a two-line empty stub, so the extension exists solely as a vehicle for the dropper. The combination of base64+XOR obfuscation, hidden /tmp staging, developer-machine targeting, sandbox/CI evasion, and daemonized execution of remote shell content is a credential-stealer dropper fingerprint.