Cybersecurity researchers said three malicious Ruby gems were published to RubyGems in a supply chain campaign called SleeperGem, with the latest wave traced to July 18, 2026 and designed to deliver additional payloads on developer machines.
KEY FACTS
- Packages The rogue gems were named git_credential_manager, Dendreo and fastlane-plugin-run_tests_firebase_testlab.
- Behavior The packages acted as loaders that fetched a second stage from a Forgejo host and avoided running on build systems.
- Persistence One version installed a daemon, set cron and systemd user service persistence, and checked sudo and wheel group access.
- Spread git_credential_manager was added as a dependency to five packages, including Dendreo and fastlane-plugin-run_tests_firebase_testlab.
- Impact Users were told to treat affected machines and related secrets as compromised.
A technical analysis by StepSecurity said each malicious release was a loader that retrieved a second stage from an attacker-controlled Forgejo host. The report said the code checked for CI-related environment variables and exited if it found them, suggesting it was built to run on developer systems rather than ephemeral runners.
The report said git_credential_manager impersonated Microsoft’s Git Credential Manager, while the other two gems had been dormant for years before receiving malicious updates. It also said the releases were published directly to RubyGems without matching source commits or tags.
In the case of git_credential_manager, the code downloaded a shell script and a native binary from a public Forgejo instance, then executed the payloads. Version 2.8.3 went further by launching the binary in the background and adding persistence through cron and a systemd user service.
The disclosure said the affected packages were maintained across more than one account, which points to at least one compromised maintainer profile. It added that users who installed the gems should remove the dropped daemon, clear persistence artifacts, check for a setuid shell at /usr/local/sbin/ping6, and rotate credentials.
WHY IT MATTERS
The case shows how dormant package accounts can be reused to push malicious updates into a trusted software ecosystem. It also underscores the risk that dependency chains and developer workstations can be used to deliver follow-on payloads and steal credentials.