Cybersecurity researchers have uncovered a new software supply chain attack targeting Ruby developers, with three malicious packages uploaded to the RubyGems repository as part of a campaign named SleeperGem.
The campaign involved compromised or abused Ruby packages designed to act as malware loaders. Instead of containing the final payload directly, the malicious gems retrieved additional components from attacker-controlled infrastructure and attempted to install persistent malware on developer machines.
Security researchers from StepSecurity identified the campaign and warned that affected systems should be considered potentially compromised.
Malicious RubyGems Packages Identified
Researchers linked the attack to the following RubyGems packages:
- git_credential_manager — malicious versions 2.8.0, 2.8.1, 2.8.2, and 2.8.3, published on July 18, 2026.
- Dendreo — malicious versions 1.1.3 and 1.1.4, originally published in 2017 before receiving unauthorized updates.
- fastlane-plugin-run_tests_firebase_testlab — malicious version 0.3.2, originally released in 2018.
According to researchers, each package functioned as an initial-stage loader that downloaded additional malware components from an attacker-controlled Forgejo server.
The malicious code also checked whether it was running inside a continuous integration (CI) environment. If it detected platforms such as GitHub Actions, GitLab, CircleCI, Travis, Jenkins, or Vercel, it exited to avoid execution. This behavior suggests the attackers specifically wanted to target individual developer systems rather than automated build environments.
Attackers Used Trusted Packages to Spread Malware
One of the most concerning elements of the campaign was the impersonation of legitimate software. The git_credential_manager package appeared to mimic Microsoft’s official Git Credential Manager, increasing the chances that developers would install it unknowingly.
Researchers also found that two other packages had been inactive for years before being updated with malicious versions. The dormant nature of these projects likely made them attractive targets because older, abandoned packages often receive less scrutiny.
The malicious releases were published directly to RubyGems without corresponding updates in the original source repositories, indicating that attackers may have gained unauthorized access to publishing accounts rather than modifying legitimate project code.
Malware Deployment and Persistence Techniques
After installation, the malicious packages scanned infected systems for approximately 30 environment variables associated with development platforms and cloud services.
When conditions were suitable, the malware downloaded additional files, including:
- A deployment shell script.
- A native binary disguised as the Git Credential Manager tool.
On Windows systems, the payload was executed through PowerShell. Later versions of the malicious package expanded the attack by launching the binary as a background service and establishing persistence mechanisms.
The malware attempted to maintain access by creating scheduled execution methods, including cron jobs and systemd user services on Linux systems. Researchers also found that the malware checked whether users had passwordless administrative privileges.
If elevated access was available, the malware could rerun itself with root permissions and create a setuid root shell disguised as a networking-related system utility.
Developers Urged to Rotate Credentials
Security experts recommend that anyone who installed the affected packages assume their systems and associated credentials may have been exposed.
Recommended response actions include:
- Removing malicious files and unauthorized background services.
- Checking systems for persistence mechanisms.
- Inspecting suspicious privileged binaries.
- Rotating passwords, API keys, cloud credentials, and access tokens.
Researchers emphasized that developer environments often contain sensitive secrets, including source-control credentials, cloud access keys, and deployment tokens, making them valuable targets for supply chain attackers.
RubyGems Faces Growing Supply Chain Abuse
The SleeperGem campaign follows a series of recent attacks targeting the Ruby package ecosystem. Researchers have previously observed malicious packages being used not only to distribute malware but also as channels for storing stolen information.
In some cases, attackers abused legitimate package repositories as temporary storage locations for stolen credentials and sensitive data, taking advantage of the trust developers place in widely used platforms.
Security researchers warn that dormant packages, abandoned accounts, and unmonitored dependencies remain attractive targets for attackers seeking to compromise software supply chains.
The SleeperGem incident highlights the need for stronger package verification, account security controls, dependency monitoring, and continuous review of third-party software used in development environments.
