The w002yardprobe RubyGem contains malicious code that executes during YARD documentation generation. It runs a script that collects host identifiers and exfiltrates them to a third-party URL. The script also modifies files in the build environment and leaves sentinel files indicating its activity. The malicious behavior triggers when documentation is generated, affecting developer workstations, CI runners, or documentation hosting services that process the gem's docs.