If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (83327b9e45cb49b02f4a3681837f5acdc84f15373a85648f4409946e6fa72f75)
The gem declares an extension script in metadata.yaml that RubyGems executes during `gem install`. At install time the script reads host identifiers (hostname, username, current working directory, home directory) and the contents of /etc/resolv.conf, /etc/passwd, and /etc/hosts, then opens a TLS connection via TCPSocket to the Burp Collaborator subdomain xuv3zi1e60ibh4f1q7unf8wkjbpad01p.oastify.com on port 443 and POSTs the collected data as a JSON body. A DNS lookup to the same host is also performed. The destination is an out-of-band interaction host unrelated to any legitimate publisher infrastructure, and the behavior fires automatically on install without user interaction.