opentelemetry-exporter-otlp-common 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 8cd0f7f0435a5b18df47dc119537f3084e8d3a51cf39e2ae2abd36372ac575db
+  data.tar.gz: 60b7c399110e5987e061624dce45b7ca7710cfcb87768f2cbc761aaa7fcd4089
+SHA512:
+  metadata.gz: 12797196c078dc6fc25fa00e1851bb16a1cf44c682a3715e018a1c33d7668519d3347917589be106c0ccbfa74781ec0a00cf0391dff3ceaf4602d002edad7c01
+  data.tar.gz: a8adbe2cc013b57c13b357a77cdc62a364bbe92e509e28b86553f82dd7bc6841f7c92840244599bcaf360170a4ade9c529074b5277c705e89888fa3cdaa4e8ac

data/README.md

@@ -0,0 +1,23 @@
+# opentelemetry-exporter-otlp-common
+
+## ⚠️ SECURITY DISCLOSURE - DEPENDENCY CONFUSION PoC
+
+This package name (`opentelemetry-exporter-otlp-common`) was **not claimed** on RubyGems despite being referenced as a dependency in the official OpenTelemetry Ruby gemspec.
+
+### Reference
+- https://github.com/shopify/opentelemetry-ruby
+- https://github.com/open-telemetry/opentelemetry-ruby
+
+### Discovered & PoC by
+**l0bo** (wearehackerone)
+
+### Impact
+This gem is listed as `add_dependency 'opentelemetry-exporter-otlp-common'` in the official gemspec. Any project that depends on it could automatically pull this package via dependency resolution.
+
+### Disclosure
+This is a proof of concept for dependency confusion / supply chain vulnerability.
+Package will be taken down after responsible disclosure.
+
+---
+
+*Powered by l0bo | wearehackerone*

data/lib/opentelemetry/exporter/otlp/common/version.rb

@@ -0,0 +1,9 @@
+module OpenTelemetry
+  module Exporter
+    module OTLP
+      module Common
+        VERSION = "0.1.0"
+      end
+    end
+  end
+end

data/lib/opentelemetry/exporter/otlp/common.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+require_relative 'common/version'
+
+module OpenTelemetry
+  module Exporter
+    module OTLP
+      module Common
+      end
+    end
+  end
+end

metadata

@@ -0,0 +1,47 @@
+--- !ruby/object:Gem::Specification
+name: opentelemetry-exporter-otlp-common
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- l0bo
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2026-07-04 00:00:00.000000000 Z
+dependencies: []
+description: 'PoC: This gem name was unclaimed on RubyGems. Dependency confusion vulnerability
+  discovered by l0bo.'
+email:
+- l0bo@wearehackerone.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- README.md
+- lib/opentelemetry/exporter/otlp/common.rb
+- lib/opentelemetry/exporter/otlp/common/version.rb
+homepage: https://github.com/l0bo/opentelemetry-ruby
+licenses:
+- Apache-2.0
+metadata: {}
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '2.5'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.4.20
+signing_key:
+specification_version: 4
+summary: Common library for OpenTelemetry OTLP exporters
+test_files: []