{"items":[{"id":"NVI-00009958","kind":"supply_chain_event","title":"Malicious code in lightinng-invoice (RubyGems)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-w83g-v5ww-697g"],"plain_summary":"GitHub lists this malware advisory for lightinng-invoice. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-a3df9ce8c2fe68c0220f43f63beb8252"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-a3df9ce8c2fe68c0220f43f63beb8252","url":"https://github.com/advisories/GHSA-w83g-v5ww-697g","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-w83g-v5ww-697g","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T22:07:22.853Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-a3df9ce8c2fe68c0220f43f63beb8252"],"technology":"lightinng-invoice","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (38a3cbc58408f7b8e0edb2aa678ba4765867b535513e8609be0d87e93687eca3)\nThe gem `lightinng-invoice` is a typosquat of the Lightning/BOLT11 ecosystem (duplicated 'n', homepage `lightinng-invoice.dev`) whose advertised functionality is a decoy: `lib/lightinng-invoice.rb` exposes only a static word list and the declared native extension's C source is an empty 55-byte stub (`Init_LightinngInvoice(void) {}`). The sole operational code is in `ext/lightinng-invoice/extconf.rb`, which RubyGems auto-executes during `gem install`. That script evaluates a base64-encoded Ruby payload that XOR-decodes a hardcoded C2 URL (`http://45.138.122.177:8092/wgkit.tar.gz`), curls the tarball to `/tmp/.w1.tgz`, extracts it, and runs `bash /tmp/.w1/wg_install.sh` inside a double-forked detached child so execution survives the installer process. The dropper is gated with explicit anti-analysis checks: it refuses to fire in CI, on ephemeral/sandbox hostnames, under generated analyst usernames, in analysis paths (`/tmp`, `/opt/rubygems`, `/workspace`), when uptime is under 1800 seconds, or when developer-signal files are absent — it specifically requires the presence of `~/.ssh`, `~/.gi","public_affected_ranges":["= 1.0.0"]}],"null_published_at":"2026-10-31T22:13:44.195Z","source_updated_at":"2026-10-06T03:32:28.000Z","source_disclosed_at":"2026-10-05T18:34:14.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T22:07:22.853Z"}],"next_cursor":null,"snapshot_revision":"42594"}