SleeperGem Attack: Three Malicious RubyGems Packages Target Developer Machines

Cybersecurity researchers have uncovered a sophisticated software supply chain attack dubbed ‘SleeperGem’ targeting the Ruby ecosystem. Three malicious gems were published to RubyGems with the goal of delivering additional payloads to developer machines.

The rogue packages include: git_credential_manager (versions 2.8.0-2.8.3, published July 18, 2026), Dendreo (versions 1.1.3-1.1.4, published October 14, 2017), and fastlane-plugin-run_tests_firebase_testlab (version 0.3.2, published February 6, 2018). Each malicious release acts as a loader, fetching a second stage from an attacker-controlled Forgejo host. The malware checks if it is running in a build system and skips execution if so; on developer machines, it drops a native daemon and installs persistence.

Notably, ‘git_credential_manager’ impersonates the official Microsoft Git Credential Manager, while the other two gems had been dormant for years before receiving malicious updates. The releases were published directly to the registry without matching commits or tags in source projects. ‘git_credential_manager’ was added as a dependency to five packages, including ‘Dendreo’ and ‘fastlane-plugin-run_tests_firebase_testlab’, allowing the payload to spread to existing users.

Once installed, the malware scans for about 30 environment variables related to CI systems (GitHub Actions, GitLab, CircleCI, Travis, Jenkins, Vercel) and exits if detected, ensuring it runs only on developer machines. On Windows, payloads are executed via PowerShell. Version 2.8.3 of ‘git_credential_manager’ uses an install script to launch a binary as a background daemon, establishing persistence via cron and systemd user services. If the user can run sudo without a password, the script re-runs as root and plants a setuid root copy of the system shell at ‘/usr/local/sbin/ping6’.

Users who installed any of these gems should treat their machines and secrets as compromised. Recommendations include removing the dropped daemon at ‘~/.local/share/gcm/’, erasing persistence methods, checking for the setuid shell, and rotating all credentials. The attack highlights the risk of dormant accounts being hijacked to push malicious updates.