opentelemetry-exporter-otlp-common

⚠️ SECURITY DISCLOSURE - DEPENDENCY CONFUSION PoC

This package name (opentelemetry-exporter-otlp-common) was not claimed on RubyGems despite being referenced as a dependency in the official OpenTelemetry Ruby gemspec.

Reference

• https://github.com/shopify/opentelemetry-ruby
• https://github.com/open-telemetry/opentelemetry-ruby

Discovered & PoC by

l0bo (wearehackerone)

Impact

This gem is listed as add_dependency 'opentelemetry-exporter-otlp-common' in the official gemspec. Any project that depends on it could automatically pull this package via dependency resolution.

Disclosure

This is a proof of concept for dependency confusion / supply chain vulnerability. Package will be taken down after responsible disclosure.

---

Powered by l0bo | wearehackerone