The dopc-client RubyGem versions 1.0.0 and 10.0.0 include malicious code that performs an unconsented plaintext HTTP GET request to a hardcoded IP address. This request sends sensitive environment information such as the installer's OS username, hostname, and current working directory to a third-party endpoint controlled by the author. The behavior occurs as a side effect of requiring the gem and is not configurable or opt-in by the user.