SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines - The Hacker News

What the report says

The Hacker News reported that cybersecurity researchers have identified a Ruby software supply-chain campaign dubbed “SleeperGem,” involving three malicious packages uploaded to RubyGems. Citing analysis from StepSecurity, the report said the packages acted as loaders designed to fetch a second-stage payload, avoid running in build environments, and execute more fully on developers’ own machines.

The packages named in the report are git_credential_manager, Dendreo and fastlane-plugin-run_tests_firebase_testlab. The git_credential_manager gem, published in several versions on July 18, 2026, appeared to mimic Microsoft’s legitimate Git Credential Manager. The other two packages had been largely inactive for years before new malicious releases appeared. The report said the malicious releases were pushed directly to RubyGems without matching source-code commits or tags, and that git_credential_manager was added as a dependency to several other packages, potentially broadening exposure among existing users.

According to StepSecurity’s findings as described by The Hacker News, the malware checks for environment variables associated with CI/CD services such as GitHub Actions, GitLab, CircleCI, Travis, Jenkins and Vercel, then exits if it detects those systems. On developer machines, it can download a script and native binary from a public Forgejo host, install a background daemon, and set persistence through cron and systemd user services. The report also described possible privilege-escalation behavior under certain sudo conditions.

Users who installed the affected gems were advised in the report to treat machines and related secrets as compromised, remove the dropped files and persistence mechanisms, check for a suspicious setuid shell path, and rotate credentials. The incident adds to recent concerns about RubyGems abuse, including malicious package publishing and cases where the registry was reportedly used as a storage point for stolen data.