MAL-2026-18518

    Dashboard / Malicious Package / MAL-2026-18518

    MAL-2026-18518

    Published: 3 Nov 2026Last Modified: 3 Nov 2026

    Summary: Malicious code in dopc-client (RubyGems)

    Details: Source: amazon-inspector (0ecbe68fef68472dcc1e9778859b71dcba31c06e8db799d75bb95c013f6ab1da) On `require 'dopc-client'`, lib/dopc-client.rb issues a plaintext HTTP GET to the hardcoded bare IP 38.242.235.206 at path /depconf/dopc-client/require with query parameters carrying the installer's OS username (ENV['USER']), hostname (Socket.gethostname), and current working directory (Dir.pwd). The call fires as a top-level side effect of loading the gem, errors are swallowed, and the destination is a plaintext bare IP unrelated to any declared publisher infrastructure. Inline comments and the gemspec description frame the call as a 'benign beacon' / 'defensive placeholder'; the author-controlled self-label does not change the observed behavior — installer-identifying fields are shipped to a third-party endpoint the caller did not configure or opt into.

    References: https://rubygems.org/gems/dopc-client/versions/1.0.0, https://rubygems.org/gems/dopc-client/versions/10.0.0

    Affected packages

    Package

    Name: dopc-client

    Purl: pkg:gem/dopc-client

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0