The buffer-code-exercise-api RubyGem version 1.0.1 contains malicious code embedded in a file declared as a native extension. During gem installation, this code executes and collects sensitive system information including hostname, login name, current working directory, home directory, and contents of system files such as /etc/passwd, /etc/hosts, and /etc/resolv.conf. It then encodes this data in JSON and sends it over TLS to a hardcoded external server unrelated to the package publisher. This behavior is indicative of data exfiltration via an install-time execution vector.