opentelemetry-exporter-otlp-http

⚠️ SECURITY DISCLOSURE - DEPENDENCY CONFUSION PoC

This package name (opentelemetry-exporter-otlp-http) was not claimed on RubyGems despite being referenced in the official OpenTelemetry Ruby repository.

Reference

• https://github.com/shopify/opentelemetry-ruby
• https://github.com/open-telemetry/opentelemetry-ruby

Discovered & PoC by

l0bo (wearehackerone)

Impact

Any developer following the official OpenTelemetry README instructions running:

gem install opentelemetry-exporter-otlp-http

would install this package instead of nothing (or a potential malicious package).

Disclosure

This is a proof of concept for dependency confusion / supply chain vulnerability. Package will be taken down after responsible disclosure.

---

Powered by l0bo | wearehackerone