If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (4ab38ebb03685b0ddfa31074b056e0a95da764170efe3026ed822ff7c8b3c247)
The gemspec declares ext/mkrf_conf.rb as a native extension, causing it to execute automatically during `gem install`. The script ships no C/C++/Rust sources and performs no build work. Instead it collects host identifiers (hostname, username) and reads /etc/passwd, /etc/hosts, and /etc/resolv.conf, then opens a TLS connection to the hardcoded Burp Collaborator subdomain 8enejtlpqb2m1fzcaieyzjgv3m9mxcl1.oastify.com on port 443 and POSTs the collected JSON. A DNS lookup to the same subdomain is also performed. The script writes a.installed marker and exits. The extension hook exists solely as an install-time execution vector for this exfiltration payload.