SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines

A sophisticated software supply chain attack, known as SleeperGem, is targeting Ruby developers by exploiting three previously inactive RubyGems packages. The attack leverages a compromised RubyGems account that had been dormant for years, making it appear harmless until it was reactivated to deliver the malicious software. The rogue gems are:

• git_credential_manager (versions 2.8.0, 2.8.1, 2.8.2, 2.8.3) - Published on July 18, 2026
• Dendreo (versions 1.1.3, 1.1.4) - Published on October 14, 2017
• fastlane-plugin-run_tests_firebase_testlab (version 0.3.2) - Published on February 06, 2018

Each malicious release is a loader. It fetches a second stage from an attacker-controlled Forgejo host, checks whether it’s running in a build system and skips if it is, and on a developer machine it drops a native daemon and installs persistence. The ‘git_credential_manager’ gem, for example, impersonates the official Microsoft Git Credential Manager, while ‘Dendreo’ and ‘fastlane-plugin-run_tests_firebase_testlab’ had been dormant for years before receiving the malicious updates.

“A RubyGems account that has gone quiet for six or seven years doesn't look risky to anyone,” said Aikido Security researcher Charlie Eriksen. “That’s exactly the profile worth taking over.”

Once installed, the malware scans for environment variables related to CI/CD systems like GitHub Actions, GitLab, CircleCI, Travis, Jenkins, and Vercel. If any are found, the process exits. The check is an intentional attempt to avoid running on ephemeral CI runners and ensure execution on a developer machine. ‘git_credential_manager’ uses PowerShell on Windows to execute the malicious code, downloading two payloads from Forgejo. Version 2.8.3 moves to the next phase, installing a background daemon and establishing persistence using a cron entry and systemd user service. If the user can run sudo without a password, the script re-runs itself as root, planting a setuid root copy of the system shell at a path mimicking a networking utility.

Users who have installed any of these gems are advised to treat their machines and associated secrets as compromised. Recommended remediation steps include removing the dropped daemon at `~/.local/share/gcm/`, erasing persistence methods, checking for a setuid shell at `/usr/local/sbin/ping6`, and rotating all credentials.

This attack follows a pattern of similar RubyGems supply chain attacks, including one earlier this month that used a malicious browser extension to steal credentials and upload them as RubyGems packages. Specifically, a malicious browser extension harvested credentials through a locally accessible API, packaged them into valid .gem files within the browser using JavaScript and standard Web APIs, and uploaded them directly to RubyGems.org using a hard-coded RubyGems API key. The haul included plaintext passwords, SSH private keys, AWS credentials, crypto wallet seed phrases, Social Security numbers, credit card numbers, and bank account details across 63 vault items. RubyGems was not the delivery mechanism; it was a ‘dead drop’ – a trusted, high-traffic domain where stolen data sat until the attacker came back for it, invisible among normal developer uploads.