GCVE-110-OSM-2026-13234

This package is a part of a large coordinated attack on RubyGems and installs a persistent reverse-shell backdoor. This malware uses the C extension build path as the execution vector. The `extconf.rb` file contains base64-encoded content that, when decoded, yields a hardcoded IP address and an `open(` call to the C2 infrastructure. The `eval()` call in the same file executes the decoded payload, and `fork do` spawns a detached background process, enabling persistence after installation completes. ie., a reverse shell. OBFUSCATION - Decoded Base64 Content in ext/req_throttle_mini/extconf.rb - recovered 1 ips from decoded/deobfuscated content ADDITIONAL FINDINGS - Homebrew Arbitrary Ruby Execution in ext/req_throttle_mini/extconf.rb: "eval(" - Homebrew Ruby Process Spawning in ext/req_throttle_mini/extconf.rb: "fork do" - Ruby C Extension Declaration in ext/req_throttle_mini/extconf.rb: "require 'mkmf'" PAYLOAD FILES ext/req_throttle_mini/extconf.rb