SleeperGem: Malicious RubyGems Packages Target Developers' Machines
Three rogue gems in RubyGems registry launch supply chain attacks.
1Operation SleeperGem
Security researchers uncovered SleeperGem, a new software supply chain attack targeting Ruby developers. Three malicious Ruby gems were published to RubyGems to deliver secondary payloads to developer machines. One package impersonated Microsoft's official Git Credential Manager tool, while others hijacked dormant projects.
2Infection Vector
Attackers strategically added the malicious 'git_credential_manager' as a dependency to five Ruby projects. This caused automatic updates to spread the malware. Notably, two other packages received malicious updates after years of inactivity - a clever tactic to avoid suspicion while compromising existing user bases through dependency chains.
3Targeted Execution Logic
The malware checks for CI/CD environment variables (GitHub Actions, GitLab etc.) and self-terminates if detected, proving it specifically targets developers' local machines. Upon successful infection, it establishes persistent background services and escalates privileges, even creating setuid root shells on vulnerable systems.
4Data Exfiltration
The malicious code harvests over 30 environment variables including CI tool credentials, AWS keys, SSH certificates, and cryptocurrency wallet seeds. On Windows systems, it downloads additional payloads via PowerShell. The attack demonstrates sophisticated credential harvesting capabilities specifically tailored for developer environments.
5RubyGems as Attack Vector
This incident highlights how package registries like RubyGems can be weaponized in supply chain attacks. Attackers compromised long-dormant maintainer accounts to push malicious updates unnoticed. Similar campaigns have previously abused RubyGems as 'dead drops' for exfiltrated data, blending stolen information with legitimate package uploads.
6Mitigation Steps
Affected developers should treat machines as compromised. Critical actions include: removing the ~/.local/share/gcm/ daemon, checking for /usr/local/sbin/ping6 setuid shells, eliminating persistence mechanisms, and rotating all credentials. Regular dependency audits and monitoring inactive account activity are essential preventative measures.