Malicious code was discovered in the RubyGems control-character-command-injection (CCCI) package. The code declares an extension script in its metadata that RubyGems executes during installation. This script collects system information, including hostname, username, and directory paths, and sends it to a third-party server via a TLS connection. The server is not affiliated with the package publisher and receives data without user interaction. This vulnerability allows unauthorized data collection and is considered a security risk for systems using RubyGems. Developers and operators should update their dependencies and review their package installation processes to mitigate this issue.