req-throttle-mini

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (91bd1a5cb0c3bacb52c303b598c520dff6f40695affdb1643dd502cf3981d797)
The gem's native-extension script extconf.rb base64-decodes an embedded Ruby payload, writes it to a randomized file under the system temp directory, and spawns a detached `ruby` process on it before invoking mkmf's `create_makefile`. The decoded payload opens a TCP connection to the hardcoded bare IP 45.138.12.177 on port 8089 and bridges the socket bidirectionally to `/bin/sh`, giving the remote endpoint interactive command execution on the installing host. The payload loops with a 30-second sleep to re-dial on disconnect, providing persistent reconnection. The C2 destination is concealed as a base64 literal rather than appearing in plaintext, and the behavior is unrelated to any native build step.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/7a674f02be3a0d93158ef0b6ee0a04edc5d547fa/osv/malicious/rubygems/req-throttle-mini/MAL-2026-17568.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/7a674f02be3a0d93158ef0b6ee0a04edc5d547fa/osv/malicious/rubygems/req-throttle-mini/MAL-2026-17568.json
- https://rubygems.org/gems/req-throttle-mini/versions/1.0.0
- https://github.com/ossf/malicious-packages/blob/68375bfc9669351706a5a45c5039509f189d8e09/osv/malicious/rubygems/req-throttle-mini/MAL-2026-17568.json
- https://safedep.io/rubygems-crypto-gems-install-time-reverse-shell
- https://github.com/advisories/GHSA-mvgr-wfjm-xr5v

Compromised versions (1)

• = 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.