SleeperGem Attack Hijacks Dormant RubyGems to Hit Devs
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- SleeperGem is a supply chain attack uncovered by StepSecurity and Aikido Security involving three malicious RubyGems — git_credential_manager (versions 2.8.0–2.8.3, published July 18, 2026), Dendreo (1.1.3 and 1.1.4, originally published October 14, 2017), and fastlane-plugin-run_tests_firebase_testlab (0.3.2, originally published February 6, 2018) — each acting as a loader that fetches a second-stage payload from an attacker-controlled Forgejo host.
- git_credential_manager impersonates the official Microsoft Git Credential Manager, while Dendreo and fastlane-plugin-run_tests_firebase_testlab had been dormant since October 2020 and March 2019 respectively before receiving malicious updates published without matching source commits or tags.
- The malicious git_credential_manager versions were added as a dependency to five packages (Dendreo, fastlane-plugin-run_tests_firebase_testlab, slackHtmlToMarkdown, seo_optimizer, array_fast_methods), spreading the payload to existing users; most packages share the "LR-DEV" maintainer while git_credential_manager belongs to "pinkroom," indicating multiple accounts were compromised.
- The embedded malware scans for roughly 30 environment variables tied to GitHub Actions, GitLab, CircleCI, Travis, Jenkins, and Vercel and immediately exits if any are detected — an intentional filter to avoid ephemeral CI runners and ensure execution on developer machines.
- Version 2.8.3 of git_credential_manager escalates the attack by launching the binary as a background daemon, establishing persistence via a cron entry and systemd user service, and — if sudo can run without a password — planting a setuid root shell disguised as a networking utility at /usr/local/sbin/ping6.
- Aikido Security researcher Charlie Eriksen explained the name: "A RubyGems account that has gone quiet for six or seven years doesn't look risky to anyone... That's exactly the profile worth taking over," noting the attackers hijacked ordinary dormant accounts rather than planting long-game assets.
- RubyGems as an attack surface has been exploited repeatedly in recent months — RubyGems briefly paused sign-ups after a spam-publishing campaign, Socket flagged 150 gems used as data exfiltration channels, and Mend.io documented 14 gems used as a dead drop storing stolen plaintext passwords, SSH keys, AWS credentials, crypto seed phrases, SSNs, and credit card numbers across 63 vault items.
Why it matters: Any developer machine that installed the affected gems must be treated as compromised: the payload establishes persistence as a daemon, plants a setuid root shell if sudo is unrestricted, and exfiltrates credentials — and because git_credential_manager was wired in as a dependency to five other packages, the blast radius extends to anyone who trusted those downstream gems. The technique of reviving years-dormant accounts shows that registry hygiene alone cannot catch hijacks, since accounts idle since 2017–2020 looked harmless to observers.
