GCVE-110-OSM-2026-13349

This package is a part of a large coordinated attack on RubyGems involving more than 40 packages. This campaign was published by the reqthrottle_3474 RubyGems account and it executes an install-time payload via extconf.rb that establishes a reverse shell or downloads a second-stage payload from attacker infrastructure, targeting developers working with cryptocurrency/blockchain tooling. DESCRIPTION This malware uses the C extension build path as the execution vector. The `extconf.rb` file contains base64-encoded content that, when decoded, yields a hardcoded IP address and an `open(` call to the C2 infrastructure. The `eval()` call in the same file executes the decoded payload, and `fork do` spawns a detached background process, enabling persistence after installation completes. OBFUSCATION - Decoded Base64 Content in ext/req_throttle_mini/extconf.rb - recovered 1 ips from decoded/deobfuscated content ADDITIONAL FINDINGS - Homebrew Arbitrary Ruby Execution in ext/req_throttle_mini/extconf.rb: "eval(" - Homebrew Ruby Process Spawning in ext/req_throttle_mini/extconf.rb: "fork do" - Ruby C Extension Declaration in ext/req_throttle_mini/extconf.rb: "require 'mkmf'" PAYLOAD FILES ext/req_throttle_mini/extconf.rb