SleeperGem Attack Plants Backdoors in RubyGems to Hit Developer Machines

Cybersecurity researchers at StepSecurity have uncovered a new software supply chain campaign dubbed SleeperGem targeting the Ruby ecosystem through three malicious RubyGems packages: git_credential_manager (versions 2.8.0–2.8.3, published July 18, 2026), Dendreo (versions 1.1.3 and 1.1.4), and fastlane-plugin-run_tests_firebase_testlab (version 0.3.2). The rogue packages impersonated legitimate developer tools — most notably Microsoft Git Credential Manager — while Dendreo and fastlane-plugin-run_tests_firebase_testlab sat dormant for years before receiving malicious updates that had no matching commits or tags in their source repositories. Four of the affected packages are maintained by a single account ("LR-DEV"), while fastlane-plugin-run_tests_firebase_testlab is maintained by "pinkroom," suggesting that multiple developer accounts were compromised to push the tainted versions to the registry.

Each malicious release acts as a first-stage loader that fetches a second-stage payload from an attacker-controlled Forgejo instance at git.disroot[.]org/git-ecosystem. Before execution, the malware scans the host for roughly 30 environment variables associated with GitHub Actions, GitLab CI, CircleCI, Travis, Jenkins, and Vercel, terminating immediately if any are found — an explicit anti-analysis measure designed to ensure the payload runs exclusively on developer workstations. Versions 2.8.2 of git_credential_manager merely stages the components, but 2.8.3 escalates the attack by invoking the install script to deploy a persistent native daemon, delivered via a shell script ("deploy.sh") and a binary mimicking the credential manager's name. On Windows systems, the fetched components are launched through PowerShell, granting the attacker stealthy persistence on long-lived developer machines that typically bypass the scrutiny applied to ephemeral CI runners.

The targeting of developer credentials and build environments via hijacked package registries underscores why supply-chain hygiene and post-install behavior monitoring are now non-negotiable for engineering teams. Developers who installed any of the flagged gems are urged to audit their systems for unexpected persistence mechanisms, rotate secrets, and verify the integrity of build tooling with a privacy checkup and port scanner to surface suspicious outbound listeners. Given that leaked or reused developer credentials frequently seed these types of intrusions, running a breach checker on primary email accounts and replacing any exposed passwords via the password checker remains a critical first step in containment and remediation.