mal-2026-18518

{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "lib/dopc-client.rb",
              "sha256": "618b5d5e3aecab993d53661634c168b3ba5a6fbeab316edc47dbfe1c8ea35c57",
              "tlsh": "ecf00ee0f3c0e100fa02832170661305e253f0121870bc61a81262c913a4f0277259ba"
            }
          ],
          "package_integrity": [
            {
              "filename": "dopc-client-1.0.0.gem",
              "hashes": {
                "sha256": "f5fd1db180f8c39ac0fa64e5b9c866f0b054ab6ed5fb0c8d0ce811e9f1e6cc26"
              }
            }
          ]
        },
        "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/rubygems/dopc-client/MAL-2026-18518.json"
      },
      "package": {
        "ecosystem": "RubyGems",
        "name": "dopc-client",
        "purl": "pkg:gem/dopc-client"
      },
      "versions": [
        "1.0.0",
        "10.0.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-022529",
        "import_time": "2026-11-03T06:20:34.294315659Z",
        "modified_time": "2026-11-03T05:46:10Z",
        "sha256": "0ecbe68fef68472dcc1e9778859b71dcba31c06e8db799d75bb95c013f6ab1da",
        "source": "amazon-inspector",
        "versions": [
          "1.0.0"
        ]
      },
      {
        "id": "IN-MAL-2026-022530",
        "import_time": "2026-11-03T06:20:34.370620453Z",
        "modified_time": "2026-11-03T05:46:18Z",
        "sha256": "7d5e44ca4d910ac8b18e5f0cf83fe6d9cbee634ba01c548361071b98c4095c0f",
        "source": "amazon-inspector",
        "versions": [
          "10.0.0"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0ecbe68fef68472dcc1e9778859b71dcba31c06e8db799d75bb95c013f6ab1da)\nOn `require 'dopc-client'`, lib/dopc-client.rb issues a plaintext HTTP GET to the hardcoded bare IP 38.242.235.206 at path /depconf/dopc-client/require with query parameters carrying the installer's OS username (ENV['USER']), hostname (Socket.gethostname), and current working directory (Dir.pwd). The call fires as a top-level side effect of loading the gem, errors are swallowed, and the destination is a plaintext bare IP unrelated to any declared publisher infrastructure. Inline comments and the gemspec description frame the call as a 'benign beacon' / 'defensive placeholder'; the author-controlled self-label does not change the observed behavior — installer-identifying fields are shipped to a third-party endpoint the caller did not configure or opt into.\n",
  "id": "MAL-2026-18518",
  "modified": "2026-11-03T06:31:19.888001338Z",
  "published": "2026-11-03T05:46:10Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://rubygems.org/gems/dopc-client/versions/1.0.0"
    },
    {
      "type": "PACKAGE",
      "url": "https://rubygems.org/gems/dopc-client/versions/10.0.0"
    }
  ],
  "schema_version": "1.9.2",
  "summary": "Malicious code in dopc-client (RubyGems)"
}