SleeperGem Attack Targets Ruby Developers via Malicious Gems
A new supply chain attack called SleeperGem uses compromised RubyGems packages to target developer machines. The campaign highlights growing risks in open-source ecosystems.
TL;DR
- Cybercriminals launched SleeperGem, a supply chain attack using three malicious RubyGems packages.
- Affected gems include git_credential_manager and Dendreo, with multiple compromised versions.
- Attack aims to deliver secondary payloads onto developers' systems.
- Organizations using Ruby should audit dependencies and monitor for suspicious package updates.
- Supply chain threats like this underscore the need for robust software composition analysis tools.
Security researchers have uncovered a new software supply chain attack named SleeperGem, which leverages malicious Ruby packages to infiltrate developer environments. The threat actors published compromised versions of legitimate-seeming gems to the RubyGems repository, aiming to execute follow-on attacks.
This discovery underscores the persistent risk posed by untrusted third-party dependencies in modern development workflows. As organizations continue to rely heavily on open-source libraries, understanding and mitigating these threats becomes critical for maintaining secure software pipelines.
Malicious Gems and Timeline
- Three gems were identified as part of the SleeperGem campaign: git_credential_manager and Dendreo.
- git_credential_manager had four malicious versions published starting July 18, 2026.
- Dendreo was also found with compromised versions 1.1.3 and 1.1.4.
- These packages masqueraded as legitimate utilities to evade detection during installation.
Impact and Defensive Measures
- The primary objective appears to be initial access, with plans to deploy additional malware post-infection.
- Ruby-based projects that pulled these gems may have exposed their build environments or CI/CD systems.
- Development teams should immediately audit their dependency trees for the affected packages.
- Implementing automated scanning tools can help detect similar threats before they reach production.
- Maintaining an allowlist of trusted sources and enforcing signed commits can reduce exposure to such attacks.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.