SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines

Summary

Cybersecurity researchers discovered SleeperGem, a supply chain attack targeting the Ruby ecosystem through three malicious gems published to RubyGems: git_credential_manager (impersonating Microsoft's tool), Dendreo, and fastlane-plugin-run_tests_firebase_testlab. The malware fetches second-stage payloads from an attacker-controlled Forgejo host, checks for CI/CD environments to avoid detection, and establishes persistence on developer machines through daemon installation, cron entries, and systemd services. Multiple maintainer accounts appear compromised, with the malicious packages added as dependencies to spread the payload to existing users.

Full text

SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines Ravie LakshmananJul 20, 2026Malware / Application Security Cybersecurity researchers have flagged a new software supply chain attack codenamed SleeperGem targeting the Ruby ecosystem after three malicious gems were published to RubyGems with the end goal of serving additional payloads. The rogue gems are listed below - git_credential_manager (versions 2.8.0, 2.8.1, 2.8.2, 2.8.3) - Published on July 18, 2026 Dendreo (versions 1.1.3, 1.1.4) - Published on October 14, 2017 fastlane-plugin-run_tests_firebase_testlab (version 0.3.2) - Published on February 06, 2018 "Each malicious release is a loader," StepSecurity said in an analysis. "It fetches a second stage from an attacker controlled Forgejo host, checks whether it is running in a build system and skips if it is, and on a developer machine it drops a native daemon and installs persistence." One aspect of the attack that immediately stands out is that "git_credential_manager" impersonates the official Microsoft Git Credential Manager, while the other two had been dormant for years before receiving the malicious updates. "Dendreo" was last updated on October 24, 2020, and "fastlane-plugin-run_tests_firebase_testlab" stayed inactive since March 9, 2019, prior to the new versions. Another defining trait of the activity is that the releases were published directly to the registry without any matching commit or tag in the source projects. Interestingly, "git_credential_manager" has been added as a dependency to five packages, including "Dendreo" and "fastlane-plugin-run_tests_firebase_testlab," effectively allowing the malicious payload to spread to existing users of the packages - Dendreo fastlane-plugin-run_tests_firebase_testlab slackHtmlToMarkdown seo_optimizer array_fast_methods All the aforementioned packages, with the exception of "fastlane-plugin-run_tests_firebase_testlab," are maintained by the same account ("LR-DEV"). The fact that the gem belongs to a different maintainer ("pinkroom") indicates that more than one account was likely compromised to push the rogue versions to RubyGems. Once installed, the malware embedded in these packages scans the infected system for about 30 environment variables, including those related to GitHub Actions, GitLab, CircleCI, Travis, Jenkins, and Vercel. If any of those are identified, it promptly exits. The check is assessed to be an intentional attempt to avoid running on ephemeral CI runners and ensure it's executed on a developer machine. In the case of "git_credential_manager," the malicious code is fired when the library is required, causing it to download two payloads from a public Forgejo instance ("git.disroot[.]org/git-ecosystem"): a shell script ("deploy.sh") and a native binary that carries the same name as the tool the gem masquerades as. On Windows, the retrieved payload is executed via PowerShell. While version 2.8.2 merely stages the payloads, version 2.8.3 of the gem moves to the next phase of the attack. This involves using the install script to launch the binary as a background daemon, after which it establishes persistence using a cron entry and as a systemd user service and queries the sudo and wheel groups. "If the user can run sudo without a password, the script re-runs itself as root, and when it runs as root it plants a setuid root copy of the system shell at a path chosen to mimic a networking utility," StepSecurity said. Users who have installed any of the aforementioned gems are advised to treat the machines and associated secrets as compromised. It's also recommended to remove the dropped daemon at "~/.local/share/gcm/," erase the persistence methods, check for a setuid shell at "/usr/local/sbin/ping6," and rotate all credentials. "A RubyGems account that has gone quiet for six or seven years doesn't look risky to anyone," Aikido Security researcher Charlie Eriksen said. "That's exactly the profile worth taking over. That's where the SleeperGem name comes from: not a planted, long-game attacker asset, but a real, ordinary account that had simply gone dormant, and looked harmless enough to hijack without anyone noticing." RubyGems as a Data Exfiltration Dead Drop The disclosure comes more than two months after RubyGems briefly paused account sign-ups after bad actors pushed dozens of malicious packages as part of a coordinated spam-publishing campaign. Around the same time, Socket researchers flagged a parallel campaign that flooded the registry with 150 gems that abused them as a data exfiltration channel. Earlier this month, Mend.io disclosed details of an undocumented software supply chain attack that employed another set of 14 RubyGems packages to store stolen credential data. Specifically, a malicious browser extension was found to have harvested credentials through a locally accessible API, packaged the information into valid .gem files entirely within the browser using JavaScript and standard Web APIs, and uploaded those packages directly to RubyGems.org using a hard-coded RubyGems API key. "The haul included plaintext passwords, SSH private keys, AWS credentials, crypto wallet seed phrases, Social Security numbers, credit card numbers, and bank account details across 63 vault items," Maciej Mensfeld said. "RubyGems wasn't the delivery mechanism here. It was the dead drop: a trusted, high-traffic domain where stolen data sat until the attacker came back for it, invisible among normal developer uploads." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  Application Security, Developer Security, linux, Malware, Open Source, privilege escalation, Software Supply Chain, Windows Security ⚡ Top Stories This Week URGENT - Progress Tells ShareFile Customers to Shut Down Storage Zone Controllers Over Security Threat Misconfigured Server Reveals Three Evilginx Phishing Operations Targeting Microsoft 365 Meta Files Patent for AI That Can Listen All Day and Track How You're Feeling New MemGhost Attack Plants Persistent False Memories in AI Agents Through One Email Microsoft Maps Three Salesforce Attack Paths Tied to a Year of ShinyHunters Activity OAuth Client ID Spoofing Lets Attackers Validate Stolen Microsoft Entra Credentials 11 Old Microsoft-Signed Linux UEFI Shims Could Let Attackers Bypass Secure Boot Researchers Say Claude for Chrome Flaw Lets Rogue Extensions Trigger Gmail Reads Microsoft Patches Record 622 Flaws, Including Two Zero-Days Under Active Attack Cursor Flaw Lets Malicious Cloned Repositories Trigger Windows Code Execution Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday TuxBot v3 Evolution Shows Signs of LLM-Assisted IoT Botnet Development Unpatched Shark Vacuum Flaw Could Let Attackers Control Other Vacuums Region-Wide New Agent Data Injection Attack Can Make AI Agents Misclick or Run Attacker Commands New ClickLock macOS Stealer Kills Apps Every 210ms Until Victims Type Their Password ThreatsDay: Game Cheat Spyware, 24-Hour Ransomware, Chrome Sync Stalking + 12 More Stories E.U. Orders Google to Open Android Mic, Camera and Screen to Rival AI Assistants OpenSSL HollowByte Flaw Could Freeze Server Memory with 11-Byte TLS Requests New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code ⭐ Featured Resources What Security Teams Must Defend in the New AI Software Supply Chain Identity Fraud Is Changing Fast. See the Attacks Businesses Face in 2026 What 25 Million Alerts Reveal About the Threats SOCs Ignore How to Find and Control Every Script Running Through Your Marketing Stack Modern SASE Guide: Close the Gaps Traditional Network Security Cannot See

Indicators of Compromise

• domain — git.disroot.org
• malware — SleeperGem
• malware — git_credential_manager (malicious versions 2.8.0-2.8.3)
• malware — Dendreo (malicious versions 1.1.3, 1.1.4)
• malware — fastlane-plugin-run_tests_firebase_testlab (malicious version 0.3.2)

Entities