Installing donjon-ledger runs ext/mkrf_conf.rb, which opens an HTTPS connection to an oastify.com Burp Collaborator host.
donjon-ledger is a Ruby gem with a single published version, 2.0.2 (November 06, 2026), described by its author as "A simple gem for demonstration purposes". It is no longer hosted on RubyGems.org: its only version is yanked. Installing it is not benign — the gem's install hook makes a covert HTTPS connection to a Burp Collaborator callback host, which exists so an operator can observe that the gem was installed and receive the request it sends.
What donjon-ledger does
When someone installs donjon-ledger 2.0.2, RubyGems runs the gem's extension script, ext/mkrf_conf.rb (declared in the gemspec's s.extensions), during installation. That script resolves the hostname 8enejtlpqb2m1fzcaieyzjgv3m9mxcl1.oastify.com and opens a TCP connection on port 443 to the host it resolves to — publicinteractionnlb-3bddf5ff6abb91b6.elb.eu-west-1.amazonaws.com, 54.77.139.23, the Burp Collaborator service behind oastify.com — and then writes and reads over that TLS connection. oastify.com is the Burp Collaborator service; a unique subdomain such as this one lets its operator see that a request arrived, read the data it carried, and see the sender's IP address. Nothing in the gem's stated purpose requires any network access at all, and the destination is not the gem's own service.
What the code does
The package's source text is no longer published on RubyGems.org, so the lines of ext/mkrf_conf.rb and lib/donjon/ledger.rb cannot be quoted here. The gemspec (donjon-ledger.gemspec) declares s.extensions = ["ext/mkrf_conf.rb"], which is what makes RubyGems execute that script during installation. The install-time behaviour — resolving the oastify.com subdomain and then connecting to 54.77.139.23:443, writing and reading over TLS — is the extension script's work; no other part of the package runs at install. The body of the request travels inside TLS and is not visible in the published artifact; the connection itself is the beacon, and at minimum it tells the collaborator operator that the gem was installed and from which IP address.
Timeline (UTC)
| When | What |
|---|
| November 06, 2026 | donjon-ledger 2.0.2 published to RubyGems.org — the only version ever published |
| November 07, 2026 | 2.0.2 yanked; the gem is no longer served by RubyGems.org |
The gem was up for about a day from publication to removal.
If you installed it
Uninstall the gem. The install hook has already made an outbound HTTPS request to the collaborator host named above, so the fact of installation and the machine's IP address were sent to the host's operator; treat the request body as having carried whatever the hook chose to send, and review the account and environment the install ran under for anything that should be rotated or checked.
