If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (bb6afd419500201966e8ccb55d2f3c8ea28caae5ec8bfc59a87dcf19ca9d022b)
The gem declares mkrf_conf.rb as a native extension in metadata.yaml, causing it to execute automatically during `gem install`. The script collects the installer's current working directory, home directory path, hostname, login name, and the contents of /etc/resolv.conf, /etc/passwd, and /etc/hosts, then opens a TCP+TLS connection to the hardcoded Burp Collaborator subdomain unl0sfubzxb8a18yj4nk85phc8i66wul.oastify.com on port 443 and POSTs the collected data. A DNS resolution of the same oastify.com subdomain is issued first, producing an out-of-band DNS callback that confirms code execution on the installer's host even when outbound TCP/443 is blocked. The oastify.com domain is PortSwigger's OAST (Burp Collaborator) service, used to receive attacker-controlled callbacks; it has no first-party relationship to the gem's advertised purpose.