MAL-2026-18765: Malicious code in donjon-ledger (RubyGems)

--- -= Per source details. Do not edit below this line.=-

Source: amazon-inspector (4ab38ebb03685b0ddfa31074b056e0a95da764170efe3026ed822ff7c8b3c247) The gemspec declares ext/mkrfconf.rb as a native extension, causing it to execute automatically during gem install. The script ships no C/C++/Rust sources and performs no build work. Instead it collects host identifiers (hostname, username) and reads /etc/passwd, /etc/hosts, and /etc/resolv.conf, then opens a TLS connection to the hardcoded Burp Collaborator subdomain 8enejtlpqb2m1fzcaieyzjgv3m9mxcl1.oastify.com on port 443 and POSTs the collected JSON. A DNS lookup to the same subdomain is also performed. The script writes a.installed marker and exits. The extension hook exists solely as an install-time execution vector for this exfiltration payload.