A dependency-confusion placeholder, version 10.0.0, whose only code sends an HTTP request to 38.242.235.206 each time the gem is required.
dopc-client 10.0.0 is a RubyGems gem published on 2026-10-31 at 13:26 UTC by an author who gives their name only as "security researcher". It has no function: loading it with require "dopc-client" sends an HTTP request to 38.242.235.206 on port 80, a server outside any registry or project, from every program that loads it. The gem says so itself: its gemspec calls it a "defensive placeholder" with a "benign beacon only (single HTTP GET to researcher server)", held to stop an internal tool name from being taken in a dependency-confusion attack. Its version, 10.0.0, sits far above an earlier 1.0.0, which is how a dependency-confusion package wins over an internal one. Both versions were yanked from RubyGems on 2026-11-03.
What dopc-client does
Nothing useful. It ships one file, lib/dopc-client.rb, and its homepage is https://example.invalid. Its summary is "Defensive placeholder - benign beacon only, no functional code", and its description says it will be "transferred to the owning organization or deprecated immediately on request via the bug bounty report".
What the code does
lib/dopc-client.rb runs as soon as the gem is required: a program that names it in its Gemfile and loads it, or a one-line ruby -e 'require "dopc-client"', opens a plain-HTTP connection to 38.242.235.206:80, writes a request and reads the reply.- It does this every time the gem is loaded, in each program that loads it.
- The request is unencrypted, so it can be read by anything on the path, as well as by the server it goes to; whatever it carries, it tells that server which machine loaded the gem and when.
Timeline (UTC)
| When | What |
|---|
| before 2026-10-31 | dopc-client 1.0.0 published to RubyGems |
| 2026-10-31 13:26 | 10.0.0 published |
| 2026-11-03 09:35–09:41 | 1.0.0 and 10.0.0 yanked; RubyGems no longer serves the gem |
If you installed it
Look for dopc-client in Gemfile.lock files and install logs and remove it, then check which machines loaded it: each sent a request to 38.242.235.206. If you have an internal gem called dopc-client, pin its private source in your Gemfile so the public name cannot be picked up again, and block 38.242.235.206 if nothing you run needs it.
