Cybersecurity researchers have uncovered a new software supply chain attack, codenamed **SleeperGem**, which is actively targeting the **Ruby** ecosystem. The attack involves the publication of three malicious gems to **RubyGems**, with the ultimate goal of deploying additional payloads.  The rogue gems identified are: * **git_credential_manager** (versions 2.8.0, 2.8.1, 2.8.2, 2.8.3) - Published on July 18, 2026 * **Dendreo** (versions 1.1.3, 1.1.4) - Published on October 14, 2017 * **fastlane-plugin-run_tests_firebase_testlab** (version 0.3.2) - Published on February 06, 2018 According to an analysis by **StepSecurity**, "Each malicious release is a loader. It fetches a second stage from an attacker controlled Forgejo host, checks whether it is running in a build system and skips if it is, and on a developer machine it drops a native daemon and installs persistence." ### Impersonation and Dormant Account Exploitation One striking aspect of the attack is the impersonation of the official **Microsoft Git Credential Manager** by `git_credential_manager`. The other two gems, `Dendreo` and `fastlane-plugin-run_tests_firebase_testlab`, had been dormant for several years before receiving these malicious updates. `Dendreo` was last updated on October 24, 2020, and `fastlane-plugin-run_tests_firebase_testlab` had been inactive since March 9, 2019, prior to the new versions. A key indicator of compromise is that these releases were published directly to the registry without any corresponding commit or tag in their respective source projects.  Intriguingly, `git_credential_manager` was added as a dependency to five other packages, including `Dendreo` and `fastlane-plugin-run_tests_firebase_testlab`, facilitating the spread of the malicious payload to existing users. The full list of affected packages includes: * **Dendreo** * **fastlane-plugin-run_tests_firebase_testlab** * **slackHtmlToMarkdown** * **seo_optimizer** * **array_fast_methods** Most of these packages, with the exception of `fastlane-plugin-run_tests_firebase_testlab`, are maintained by the same account, **LR-DEV**. The fact that `fastlane-plugin-run_tests_firebase_testlab` is maintained by a different account, **pinkroom**, suggests that multiple accounts were likely compromised to push these rogue versions to **RubyGems**. ### Evasion and Persistence Upon installation, the malware embedded in these packages scans the infected system for approximately 30 environment variables associated with various CI/CD platforms, including **GitHub Actions**, **GitLab**, **CircleCI**, **Travis**, **Jenkins**, and **Vercel**. If any are detected, the malware exits, a tactic believed to avoid execution on ephemeral CI runners and ensure it targets developer machines. For `git_credential_manager`, the malicious code activates when the library is `required`. It then downloads two payloads from a public **Forgejo** instance (`git.disroot[.]org/git-ecosystem`): a shell script (`deploy.sh`) and a native binary named after the tool the gem impersonates. On **Windows**, the payload is executed via **PowerShell**. While version 2.8.2 merely stages the payloads, version 2.8.3 of the gem escalates the attack. It uses the install script to launch the binary as a background daemon, establishes persistence via a cron entry and a **systemd** user service, and queries the `sudo` and `wheel` groups. **StepSecurity** elaborates: "If the user can run `sudo` without a password, the script re-runs itself as root, and when it runs as root it plants a setuid root copy of the system shell at a path chosen to mimic a networking utility." Users who have installed any of the aforementioned gems should consider their machines and associated secrets compromised. Recommended actions include removing the dropped daemon at `~/.local/share/gcm/`, erasing persistence methods, checking for a setuid shell at `/usr/local/sbin/ping6`, and rotating all credentials. **Aikido Security** researcher **Charlie Eriksen** highlighted the cunning nature of the attack: "A RubyGems account that has gone quiet for six or seven years doesn't look risky to anyone. That's exactly the profile worth taking over. That's where the SleeperGem name comes from: not a planted, long-game attacker asset, but a real, ordinary account that had simply gone dormant, and looked harmless enough to hijack without anyone noticing." ### RubyGems as a Data Exfiltration 'Dead Drop' This disclosure follows recent incidents where **RubyGems** has been exploited. Earlier this year, **RubyGems** temporarily suspended account sign-ups due to a coordinated spam-publishing campaign. Concurrently, **Socket** researchers identified a campaign that flooded the registry with 150 gems used as a data exfiltration channel. More recently, **Mend.io** revealed an undocumented supply chain attack that utilized another set of 14 **RubyGems** packages to store stolen credential data. In this scenario, a malicious browser extension harvested credentials via a locally accessible API, packaged them into valid `.gem` files using **JavaScript** and standard **Web APIs**, and uploaded these packages directly to **RubyGems.org** using a hard-coded **RubyGems API key**. **Maciej Mensfeld** of **Mend.io** noted, "The haul included plaintext passwords, SSH private keys, AWS credentials, crypto wallet seed phrases, Social Security numbers, credit card numbers, and bank account details across 63 vault items." He added, "RubyGems wasn't the delivery mechanism here. It was the dead drop: a trusted, high-traffic domain where stolen data sat until the attacker came back for it, invisible among normal developer uploads."