Malicious code in agentic-call-control (RubyGems)

__

Source: amazon-inspector (6604e2b2afca5be9f394786598898c0d718100ef3cb3595590fb74949b3eb9b5)

The gem's native extension script executes during gem install and harvests installer-side data without consent. It collects host identifiers (current working directory, home directory, hostname, login name) and reads the contents of /etc/resolv.conf, /etc/passwd, and /etc/hosts, serializes them as JSON, and POSTs the payload over TLS to the hardcoded host k6rqb5d1inuytrro2u6arv87vy1vplda.oastify.com on port 443 using TCPSocket/OpenSSL. A DNS lookup to the same subdomain is also issued as an out-of-band beacon. The destination is a Burp Collaborator subdomain — attacker-controlled out-of-band interaction infrastructure unrelated to any declared publisher or build dependency. There is no native source tree or build logic that would require this network activity; the extension script's sole effect on install is reconnaissance exfiltration.