A malicious code vulnerability, identified as MAL-2026-18765, has been found in the donjon-ledger RubyGem. The issue arises from the gemspec declaring ext/mkrfconf.rb as a native extension, which executes automatically during installation. This allows the malicious code to collect host identifiers and sensitive system data, including the hostname, username, and contents of /etc/passwd, /etc/hosts, and /etc/resolv.conf. The code then sends this data to a hardcoded Burp Collaborator subdomain via a TLS connection, performing a DNS lookup to the same subdomain. This vulnerability presents a risk to users who install the affected gem, potentially allowing unauthorized data exfiltration.