If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (6604e2b2afca5be9f394786598898c0d718100ef3cb3595590fb74949b3eb9b5)
The gem's native extension script executes during `gem install` and harvests installer-side data without consent. It collects host identifiers (current working directory, home directory, hostname, login name) and reads the contents of `/etc/resolv.conf`, `/etc/passwd`, and `/etc/hosts`, serializes them as JSON, and POSTs the payload over TLS to the hardcoded host `k6rqb5d1inuytrro2u6arv87vy1vplda.oastify.com` on port 443 using `TCPSocket`/OpenSSL. A DNS lookup to the same subdomain is also issued as an out-of-band beacon. The destination is a Burp Collaborator subdomain — attacker-controlled out-of-band interaction infrastructure unrelated to any declared publisher or build dependency. There is no native source tree or build logic that would require this network activity; the extension script's sole effect on install is reconnaissance exfiltration.