Malicious code in dynamic-object-handler (RubyGems)

__

Source: amazon-inspector (bb6afd419500201966e8ccb55d2f3c8ea28caae5ec8bfc59a87dcf19ca9d022b)

The gem declares mkrf_conf.rb as a native extension in metadata.yaml, causing it to execute automatically during gem install. The script collects the installer's current working directory, home directory path, hostname, login name, and the contents of /etc/resolv.conf, /etc/passwd, and /etc/hosts, then opens a TCP+TLS connection to the hardcoded Burp Collaborator subdomain unl0sfubzxb8a18yj4nk85phc8i66wul.oastify.com on port 443 and POSTs the collected data. A DNS resolution of the same oastify.com subdomain is issued first, producing an out-of-band DNS callback that confirms code execution on the installer's host even when outbound TCP/443 is blocked. The oastify.com domain is PortSwigger's OAST (Burp Collaborator) service, used to receive attacker-controlled callbacks; it has no first-party relationship to the gem's advertised purpose.