Malicious code in lighthing-invoice (RubyGems)

Source: amazon-inspector 206884c57f9427c6952744828fa53861634d5451b97ba86885c701ee47ef5012 The gem's native-extension script ext/lighthing-invoice/extconf.rb, which executes during gem install, base64-decodes and evals a Ruby payload. The payload reconstructs an XOR-obfuscated URL...

Malicious Package

Overview lighthing-invoice is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-17606 Malicious code in lighthing-invoice (RubyGems)

RubyGems runs this gem's native extension script ext/lighthing-invoice/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

Malicious code in lighthing-invoice (RubyGems)

RubyGems runs this gem's native extension script ext/lighthing-invoice/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...