The RubyGem 'dynamic-object-handler' version 1.0.1 contains malicious code in its native extension mkrf_conf.rb. During installation, it collects sensitive system information including directory paths, hostname, login name, and contents of critical system files. This data is exfiltrated via a TLS-encrypted POST request to a hardcoded Burp Collaborator subdomain, enabling out-of-band confirmation of code execution even if outbound TCP/443 is blocked.