Cybersecurity researchers have identified a new supply chain attack, dubbed SleeperGem, targeting the Ruby programming ecosystem. This campaign involves the publication of three malicious gems on RubyGems, aiming to deploy additional payloads onto developers’ machines.
The compromised gems are:
- git_credential_manager (versions 2.8.0 to 2.8.3) – Published on July 18, 2026.
- Dendreo (versions 1.1.3 and 1.1.4) – Published on July 18, 2026, after being dormant since October 2020.
- fastlane-plugin-run_tests_firebase_testlab (version 0.3.2) – Published on July 19, 2026, following inactivity since March 2019.
Each of these malicious releases functions as a loader. Upon installation, they fetch a secondary payload from an attacker-controlled Forgejo host. The malware checks if it’s operating within a continuous integration (CI) environment and, if so, terminates its execution. On developer machines, it installs a native daemon and establishes persistence.
Notably, the git_credential_manager gem impersonates Microsoft’s official Git Credential Manager. The other two gems, Dendreo and fastlane-plugin-run_tests_firebase_testlab, had not been updated for years before these malicious versions were published. Additionally, these releases were directly uploaded to the RubyGems registry without corresponding commits or tags in their respective source repositories.
Further investigation revealed that git_credential_manager was added as a dependency to five other packages, including Dendreo and fastlane-plugin-run_tests_firebase_testlab. This strategy allowed the malicious code to propagate to users of these packages. The affected packages are:
- Dendreo
- fastlane-plugin-run_tests_firebase_testlab
- slackHtmlToMarkdown
- seo_optimizer
- array_fast_methods
All except fastlane-plugin-run_tests_firebase_testlab are maintained by the same account, suggesting that multiple maintainer accounts were likely compromised to facilitate this attack.
Upon execution, the malware scans the infected system for approximately 30 environment variables associated with various CI services, such as GitHub Actions, GitLab, CircleCI, Travis, Jenkins, and Vercel. If any of these variables are detected, the malware exits to avoid running in ephemeral CI environments, ensuring it operates on a developer’s local machine.
In the case of git_credential_manager, the malicious code activates when the library is required. It downloads two payloads from a public Forgejo instance: a shell script named deploy.sh and a native binary mimicking the legitimate tool. On Windows systems, the payload is executed via PowerShell.
Version 2.8.3 of git_credential_manager advances the attack by launching the binary as a background daemon and establishing persistence through a cron job and a systemd user service. It also checks for user privileges, attempting to escalate to root if possible. If successful, it plants a setuid root copy of the system shell in a location designed to resemble a networking utility.
Developers who have installed any of these compromised gems should consider their systems and associated credentials compromised. Immediate actions should include removing the malicious packages, rotating any exposed secrets, and thoroughly scanning systems for further signs of compromise.
This incident underscores the critical importance of vigilance in the software supply chain. Developers should regularly audit their dependencies, monitor for unusual activity, and implement robust security practices to mitigate the risk of such attacks.
