The donjon-ledger RubyGem version 2.0.2 contains malicious code executed during installation. The gemspec declares a native extension that runs a Ruby script collecting host identifiers and sensitive system files, then exfiltrates this data over a TLS connection to a hardcoded external server. This behavior occurs automatically when the gem is installed, without any legitimate build activity.