Sleeper Gem Uses Three Malicious Ruby Gems Packages to Target Developer Machines

Summary: Researchers at StepSecurity flagged a supply chain attack dubbed SleeperGem in which three malicious gems were published to RubyGems, each acting as a loader that fetches a second stage from an attacker-controlled Forgejo host, skips execution on build systems, and on developer machines drops a native daemon with persistence. One gem, "git_credential_manager," impersonates Microsoft's Git Credential Manager and was added as a dependency to five packages, while the other two - "Dendreo" and "fastlane-plugin-run_tests_firebase_testlab" - had been dormant since October 2020 and March 2019 respectively, and the releases carried no matching commit or tag in their source projects.
What you should know: The malware scans roughly 30 environment variables tied to GitHub Actions, GitLab, CircleCI, Travis, Jenkins and Vercel and exits if it finds them, so it deliberately runs only on developer machines - and if the user can run sudo without a password, it plants a setuid root shell at /usr/local/sbin/ping6.

Read the original at The Hacker News ↗

Topics: Supply Chain & AppSec
Related: Kitesurf is now open source Cyber Risks · Nov 13, 2026
Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026
ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026