What Is SleeperGem?
Cybersecurity researchers have uncovered a new software supply chain attack dubbed SleeperGem, targeting the Ruby ecosystem. The campaign involves three malicious gems published to RubyGems, designed to slip additional payloads onto developer machines.
The rogue packages are:
- git_credential_manager (versions 2.8.0, 2.8.1, 2.8.2, 2.8.3) – Published on July 18, 2026
- Dendreo (versions 1.1.3, 1.1.4) – Published on July 18, 2026
- ruby_uploader (version 0.1.0) – Published on July 18, 2026
The name SleeperGem comes from the attackers’ approach: the gems appear benign at first, but they carry hidden code that activates under specific conditions. This is a classic supply chain attack—developers install what looks like a helpful library, and it quietly compromises their environment.
How the Malicious Gems Deliver Payloads
The gems are crafted to look legitimate, with names that mimic common tools. For instance, git_credential_manager sounds like a utility for managing Git credentials—a plausible need for any developer. But the code inside tells a different story.
Once installed, the gems execute a series of steps to fetch and run additional payloads from remote servers. The attack is designed to be stealthy: it avoids immediate detection by only triggering under certain conditions, such as when the gem is used in a specific context or after a delay.
Stealth Tactics
The attackers used obfuscation to hide the malicious code within the gems. They also employed domain generation algorithms (DGAs) to make command-and-control (C2) communication harder to block. This means the gems can call home to different domains over time, making takedown efforts less effective.
Researchers at ReversingLabs first spotted the campaign and noted that the gems were published under seemingly legitimate accounts. The authors even included standard metadata like descriptions and licenses to make them look authentic.
Who Is Behind SleeperGem?
While the exact identity of the threat actors remains unknown, the techniques suggest a sophisticated group with a clear focus on the developer ecosystem. The use of multiple gems and versions indicates a planned, ongoing operation rather than a one-off test.
Interestingly, the gems were published on the same day, which could mean a coordinated release or a single actor managing multiple accounts. The choice of names—tying into Git and file uploads—suggests the attackers targeted common developer workflows to maximize the chance of installation.
Why This Matters for Developers
Supply chain attacks are on the rise, and the Ruby community is not immune. This incident follows other attacks on open-source ecosystems like npm and PyPI, but RubyGems has seen fewer high-profile cases. That makes this one particularly notable.
For developers, the risk is real: installing a single malicious gem can compromise your entire development environment, including credentials, source code, and production access. The fact that these gems were available for download means anyone who installed them is now exposed.
Here’s what you should do right now:
- Check your Gemfile.lock for the affected gems and versions.
- If you find them, remove them immediately and audit your system for suspicious activity.
- Rotate any credentials that might have been exposed.
- Use a dependency scanner to catch similar threats in the future.
Protecting Your Ruby Environment
This attack highlights the importance of verifying the gems you install. Always check the gem’s source, author reputation, and recent updates. Tools like Bundler audit can help flag known vulnerabilities, but they won’t catch everything—especially new, unpublished threats.
Consider using a private gem server or a proxy that allows only approved gems. And be wary of gems with generic names or those that request unusual permissions during installation.
The RubyGems team has been notified and has likely removed the malicious packages, but the damage may already be done. Developers who installed these gems should treat their machines as compromised and take appropriate action.
Staying Ahead of Supply Chain Threats
SleeperGem is a reminder that open-source ecosystems are a prime target for attackers. As more companies rely on open-source code, the potential for widespread impact grows. The best defense is a combination of vigilance, automated scanning, and quick response.
For a deeper look at similar threats, check out our coverage of malicious npm packages and PyPI supply chain attacks. Understanding how these attacks work across ecosystems can help you spot the warning signs early.
Stay safe out there—and always double-check what you’re installing.
