MAL-2026-18518: Malicious code in dopc-client (RubyGems)

Published Nov 3, 2026

Updated

--- -= Per source details. Do not edit below this line.=-

Source: amazon-inspector (0ecbe68fef68472dcc1e9778859b71dcba31c06e8db799d75bb95c013f6ab1da) On require 'dopc-client', lib/dopc-client.rb issues a plaintext HTTP GET to the hardcoded bare IP 38.242.235.206 at path /depconf/dopc-client/require with query parameters carrying the installer's OS username (ENV['USER']), hostname (Socket.gethostname), and current working directory (Dir.pwd). The call fires as a top-level side effect of loading the gem, errors are swallowed, and the destination is a plaintext bare IP unrelated to any declared publisher infrastructure. Inline comments and the gemspec description frame the call as a 'benign beacon' / 'defensive placeholder'; the author-controlled self-label does not change the observed behavior — installer-identifying fields are shipped to a third-party endpoint the caller did not configure or opt into.

Affected Software

1 affected component

rubygems/dopc-client=1.0.0, =10.0.0

Event History

Nov 3, 2026

Advisory Published

via OSV·05:46 AM

Data Sourced

via OSV·05:46 AM

DescriptionAffected Software

Frequently Asked Questions

What information is transmitted when the gem is loaded?

Loading the gem sends a plaintext HTTP GET containing the OS username from ENV['USER'], the system hostname, and the current working directory. The request is sent to 38.242.235.206 at /depconf/dopc-client/require.

When does the network request occur?

It occurs as a top-level side effect when require 'dopc-client' is executed. The request does not require an explicit telemetry configuration or separate application call.

Will an application notice if the outbound request fails?

Not necessarily. Errors from the request are swallowed, so a failed connection may not produce a visible error while loading the gem.

What can be done if the gem cannot be removed immediately?

The provided data identifies the hardcoded destination as 38.242.235.206 over plaintext HTTP. Blocking outbound connections to that IP can prevent the identified request, while avoiding or removing require 'dopc-client' prevents the load-time behavior.

MAL-2026-18518: Malicious code in dopc-client (RubyGems)

Affected Software

Event History

Frequently Asked Questions

What information is transmitted when the gem is loaded?

When does the network request occur?

Will an application notice if the outbound request fails?

What can be done if the gem cannot be removed immediately?

Company

Resources

Contact

Frequently Asked Questions

What information is transmitted when the gem is loaded?

When does the network request occur?

Will an application notice if the outbound request fails?

What can be done if the gem cannot be removed immediately?