SleeperGem: Three Malicious RubyGems Packages Target Developer Machines

Researchers at StepSecurity and other firms have documented a new supply-chain attack on the Ruby ecosystem, dubbed SleeperGem. Three malicious packages were published to the RubyGems registry, their job being to deliver an additional payload onto the infected machine.

The packages

One of them, git_credential_manager (versions 2.8.0–2.8.3, published on July 18, 2026), poses as the official Git Credential Manager from Microsoft. The other two — Dendreo and fastlane-plugin-run_tests_firebase_testlab — had gone years without updates (their last changes dated to 2019–2020) until they suddenly received malicious releases. None of the releases was accompanied by a corresponding commit or tag in the source repositories.

The fake git_credential_manager was added as a dependency to five packages at once, which allowed the infection to spread to their existing users. Most of the affected packages belong to a single account (LR-DEV), but one belongs to another (pinkroom), from which it follows that more than one account was compromised.

How it works

Each release, according to the researchers, is a loader. Once installed, the code scans the system for roughly 30 environment variables characteristic of GitHub Actions, GitLab, CircleCI, Travis, Jenkins, and Vercel. If it finds even one, it terminates immediately: the goal is to avoid giving itself away on disposable CI runners and to trigger specifically on a developer's machine.

On a genuine target, the loader reaches out to a public Forgejo instance (git.disroot[.]org) and downloads a shell script, deploy.sh, along with a native binary bearing the name of the utility it masquerades as. Version 2.8.3 runs the binary as a background daemon and gains persistence through cron and a user-level systemd service. If the user can run sudo without a password, the script restarts itself as root and plants a setuid copy of the system shell at a path that imitates a network utility (/usr/local/sbin/ping6).

Why “sleeper”

The name captures the essence: the attackers are hunting not for fake assets but for real accounts abandoned for six or seven years. “An account that has gone quiet for that many years doesn't look dangerous to anyone. That's exactly the kind of profile worth hijacking,” noted Aikido Security researcher Charlie Eriksen.

Victims are advised to treat their machines and associated secrets as compromised: delete the daemon from ~/.local/share/gcm/, clear out the persistence mechanisms, check for the setuid shell at the specified path, and rotate all credentials.

SleeperGem is not the only recent incident involving RubyGems. Earlier, the registry temporarily suspended registration because of a spam campaign, and researchers have recorded cases where RubyGems was used as a “stash” for storing stolen passwords, SSH keys, and bank card data.

Source: The Hacker News