{"id":"MAL-2026-18518","summary":"Malicious code in dopc-client (RubyGems)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0ecbe68fef68472dcc1e9778859b71dcba31c06e8db799d75bb95c013f6ab1da)\nOn `require 'dopc-client'`, lib/dopc-client.rb issues a plaintext HTTP GET to the hardcoded bare IP 38.242.235.206 at path /depconf/dopc-client/require with query parameters carrying the installer's OS username (ENV['USER']), hostname (Socket.gethostname), and current working directory (Dir.pwd). The call fires as a top-level side effect of loading the gem, errors are swallowed, and the destination is a plaintext bare IP unrelated to any declared publisher infrastructure. Inline comments and the gemspec description frame the call as a 'benign beacon' / 'defensive placeholder'; the author-controlled self-label does not change the observed behavior — installer-identifying fields are shipped to a third-party endpoint the caller did not configure or opt into.\n","modified":"2026-11-03T06:31:19.888001338Z","published":"2026-11-03T05:46:10Z","database_specific":{"malicious-packages-origins":[{"sha256":"0ecbe68fef68472dcc1e9778859b71dcba31c06e8db799d75bb95c013f6ab1da","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-022529","import_time":"2026-11-03T06:20:34.294315659Z","modified_time":"2026-11-03T05:46:10Z"},{"modified_time":"2026-11-03T05:46:18Z","sha256":"7d5e44ca4d910ac8b18e5f0cf83fe6d9cbee634ba01c548361071b98c4095c0f","source":"amazon-inspector","versions":["10.0.0"],"id":"IN-MAL-2026-022530","import_time":"2026-11-03T06:20:34.370620453Z"}]},"references":[{"type":"PACKAGE","url":"https://rubygems.org/gems/dopc-client/versions/1.0.0"},{"type":"PACKAGE","url":"https://rubygems.org/gems/dopc-client/versions/10.0.0"}],"affected":[{"package":{"name":"dopc-client","ecosystem":"RubyGems","purl":"pkg:gem/dopc-client"},"versions":["1.0.0","10.0.0"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"path":"lib/dopc-client.rb","sha256":"618b5d5e3aecab993d53661634c168b3ba5a6fbeab316edc47dbfe1c8ea35c57","tlsh":"ecf00ee0f3c0e100fa02832170661305e253f0121870bc61a81262c913a4f0277259ba"}],"package_integrity":[{"hashes":{"sha256":"f5fd1db180f8c39ac0fa64e5b9c866f0b054ab6ed5fb0c8d0ce811e9f1e6cc26"},"filename":"dopc-client-1.0.0.gem"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/dopc-client/MAL-2026-18518.json"}}],"schema_version":"1.9.2","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}