request-guard

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (5724f6df96af48a04d14a3a986d2ea3b31c90a66e68cfde9e116adf187e42964)
The gem's native-extension build script ext/req_throttle_mini/extconf.rb base64-decodes a Ruby payload, writes it to a random file under Dir.tmpdir, and spawns it with the Ruby interpreter before calling create_makefile. The decoded payload opens a TCP connection to the hardcoded bare IP 45.138.12.177 on port 8090 and bridges /bin/sh to the socket in a persistent reconnect loop, giving a remote party interactive shell access on the installer's host. No C/C++ source files are shipped in the gem, so the create_makefile('request-guard_native') call is cover: the extension exists solely to execute the hidden payload at install time. Installing this gem auto-executes the extension and triggers the reverse shell on the installing machine.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/7a674f02be3a0d93158ef0b6ee0a04edc5d547fa/osv/malicious/rubygems/request-guard/MAL-2026-17569.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/7a674f02be3a0d93158ef0b6ee0a04edc5d547fa/osv/malicious/rubygems/request-guard/MAL-2026-17569.json
- https://rubygems.org/gems/request-guard/versions/1.0.0
- https://github.com/ossf/malicious-packages/blob/68375bfc9669351706a5a45c5039509f189d8e09/osv/malicious/rubygems/request-guard/MAL-2026-17569.json
- https://safedep.io/rubygems-crypto-gems-install-time-reverse-shell
- https://github.com/advisories/GHSA-f88f-66w3-r384

Compromised versions (1)

• = 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.