The RubyGems package 'pentest-copilot' version 1.0.1 contains malicious code that executes during installation. It collects sensitive system information such as directory paths, hostnames, login names, and contents of local files like /etc/resolv.conf, /etc/passwd, and /etc/hosts. This data is then exfiltrated via a DNS lookup and a TLS POST request to an attacker-controlled domain. The package is flagged as malicious by the OpenSSF Package Analysis project due to its communication with a known malicious domain.