MAL-2026-18518

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/dopc-client/MAL-2026-18518.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18518
Published
2026-11-03T05:46:10Z
Modified
2026-11-03T06:31:19Z
Summary
Malicious code in dopc-client (RubyGems)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0ecbe68fef68472dcc1e9778859b71dcba31c06e8db799d75bb95c013f6ab1da)

On require 'dopc-client', lib/dopc-client.rb issues a plaintext HTTP GET to the hardcoded bare IP 38.242.235.206 at path /depconf/dopc-client/require with query parameters carrying the installer's OS username (ENV['USER']), hostname (Socket.gethostname), and current working directory (Dir.pwd). The call fires as a top-level side effect of loading the gem, errors are swallowed, and the destination is a plaintext bare IP unrelated to any declared publisher infrastructure. Inline comments and the gemspec description frame the call as a 'benign beacon' / 'defensive placeholder'; the author-controlled self-label does not change the observed behavior — installer-identifying fields are shipped to a third-party endpoint the caller did not configure or opt into.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-022529",
            "import_time": "2026-11-03T06:20:34.294315659Z",
            "modified_time": "2026-11-03T05:46:10Z",
            "sha256": "0ecbe68fef68472dcc1e9778859b71dcba31c06e8db799d75bb95c013f6ab1da",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-022530",
            "import_time": "2026-11-03T06:20:34.370620453Z",
            "modified_time": "2026-11-03T05:46:18Z",
            "sha256": "7d5e44ca4d910ac8b18e5f0cf83fe6d9cbee634ba01c548361071b98c4095c0f",
            "source": "amazon-inspector",
            "versions": [
                "10.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

RubyGems / dopc-client

Package

Name
dopc-client
Purl
pkg:gem/dopc-client

Affected ranges

Affected versions

1.*
1.0.0
10.*
10.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "lib/dopc-client.rb",
            "sha256": "618b5d5e3aecab993d53661634c168b3ba5a6fbeab316edc47dbfe1c8ea35c57",
            "tlsh": "ecf00ee0f3c0e100fa02832170661305e253f0121870bc61a81262c913a4f0277259ba"
        }
    ],
    "package_integrity": [
        {
            "filename": "dopc-client-1.0.0.gem",
            "hashes": {
                "sha256": "f5fd1db180f8c39ac0fa64e5b9c866f0b054ab6ed5fb0c8d0ce811e9f1e6cc26"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/dopc-client/MAL-2026-18518.json"