A malicious RubyGem was discovered to contain a native extension script that executes during installation, collecting sensitive host data without user consent. The script gathers details such as the current working directory, hostname, login name, and files from /etc/resolv.conf, /etc/passwd, and /etc/hosts. The collected data is then transmitted to a hardcoded server via HTTPS, with a DNS lookup also being performed to an attacker-controlled domain. This malicious activity is unrelated to the declared publisher or build dependencies, indicating a potential security risk for users installing the affected RubyGem.