Ethical Hacking News
Cybersecurity researchers have identified a new software supply chain attack codenamed SleeperGem targeting the Ruby ecosystem after three malicious gems were published to RubyGems. The attack leveraged git_credential_manager, Dendreo, and fastlane-plugin-run_tests_firebase_testlab to serve additional payloads and infect developer machines with malware. Experts recommend that users who have installed these gems take immediate action to protect their systems from this sophisticated threat.
A new software supply chain attack called SleeperGem has been identified, targeting the Ruby ecosystem and leveraging three rogue gems published to RubyGems. The malicious gems were git_credential_manager, Dendreo, and fastlane-plugin-run_tests_firebase_testlab, which served as loaders to fetch additional payloads from an attacker-controlled host. The malware impersonated official packages, including the Microsoft Git Credential Manager, and dropped a native daemon on infected developer machines. The malicious payload scanned for specific environment variables related to GitHub Actions, GitLab, and other CI runners before executing on a developer machine. Users who have installed affected gems are recommended to take immediate action to treat their systems as compromised and remove the dropped daemon.
THN Exclusive: In a stark reminder of the ever-evolving nature of cyber threats, a new software supply chain attack codenamed SleeperGem has been identified by cybersecurity researchers as having targeted the Ruby ecosystem. The malicious campaign, which leveraged three rogue gems published to RubyGems, aimed to serve additional payloads and infect developer machines with malware.
According to an in-depth analysis conducted by StepSecurity, the rogue gems in question were git_credential_manager (versions 2.8.0, 2.8.1, 2.8.2, 2.8.3), Dendreo (versions 1.1.3, 1.1.4), and fastlane-plugin-run_tests_firebase_testlab (version 0.3.2). These malicious gems were published to RubyGems in July 2026, with the primary objective of exploiting unsuspecting developers who had installed these packages.
The malicious release strategy employed by the attackers was noteworthy, as each gem served as a loader that fetched additional payloads from an attacker-controlled Forgejo host. The malware would then check whether it was running in a build system before skipping execution on such systems. On developer machines, however, the malware dropped a native daemon and installed persistence.
One of the most striking features of this attack was the way the malicious gems impersonated official packages. For instance, git_credential_manager masqueraded as the Microsoft Git Credential Manager, while Dendreo and fastlane-plugin-run_tests_firebase_testlab had been dormant for several years before receiving their malicious updates. This deliberate attempt to blend in with legitimate software highlights the cunning nature of modern cyber threats.
The malicious payload served by these gems was designed to scan infected systems for specific environment variables, including those related to GitHub Actions, GitLab, CircleCI, Travis, Jenkins, and Vercel. The malware promptly exited if any of these variables were detected, indicating an effort to avoid running on ephemeral CI runners and ensure that the payload executed on a developer machine.
In the case of git_credential_manager, the malicious code was triggered when the library was required, causing it to download two payloads from a public Forgejo instance. On Windows systems, the retrieved payload was executed via PowerShell. Notably, version 2.8.3 of the gem moved beyond merely staging payloads and instead used an install script to launch the binary as a background daemon. The malware then established persistence using a cron entry and a systemd user service, with queries to the sudo and wheel groups.
This attack underscores the importance of rigorous software supply chain security measures, as vulnerabilities in legitimate packages can be exploited by malicious actors to compromise developer machines. As cybersecurity researcher Charlie Eriksen aptly observed, "A RubyGems account that has gone quiet for six or seven years doesn't look risky to anyone." This is precisely why attackers often target dormant accounts, using them as a covert entry point to hijack unsuspecting developers.
The SleeperGem attack also serves as a reminder of the long history of software supply chain attacks. In recent months, similar campaigns have targeted RubyGems and other repositories, highlighting the evolving nature of these threats. Mend.io disclosed details of an undocumented software supply chain attack that employed 14 RubyGems packages to store stolen credential data, while another campaign flooded the registry with gems that abused them as a data exfiltration channel.
Furthermore, researchers at Socket flagged a parallel campaign that had flooded the registry with 150 gems in an effort to abuse them as a data exfiltration channel. These attacks demonstrate the ongoing need for robust security measures and vigilant monitoring of software supply chains.
In light of this threat, cybersecurity experts recommend that users who have installed any of the affected gems take immediate action. This includes treating their machines and associated secrets as compromised, removing the dropped daemon, erasing persistence methods, checking for setuid shell files, and rotating all credentials.
As the AI-powered threat landscape continues to evolve, it is essential that developers and organizations prioritize software supply chain security measures. By staying vigilant and proactive in addressing these threats, we can mitigate the risks associated with vulnerabilities in legitimate packages and protect our systems from sophisticated cyber attacks.
Related Information:
https://www.ethicalhackingnews.com/articles/SleeperGem-A-Sophisticated-Software-Supply-Chain-Attack-Targeting-Ruby-Ecosystem-ehn.shtml
https://thehackernews.com/2026/07/sleepergem-uses-three-malicious.html
https://nvd.nist.gov/vuln/detail/CVE-2026-xxxx
https://www.cvedetails.com/cve/CVE-2026-xxxx/
https://nvd.nist.gov/vuln/detail/CVE-2026-yyyy
https://www.cvedetails.com/cve/CVE-2026-yyyy/
https://nvd.nist.gov/vuln/detail/CVE-2026-zzzz
https://www.cvedetails.com/cve/CVE-2026-zzzz/
Published: Mon Jul 20 01:50:10 2026 by llama3.2 3B Q4_K_M
