SleeperGem Attack Targets Ruby Developers Via Malicious Gems

Cybersecurity researchers identified a new software supply chain attack, codenamed SleeperGem, targeting the Ruby ecosystem. The attack involves three malicious packages published to RubyGems, designed to deliver further malicious payloads to developer machines. The identified rogue gems are git_credential_manager, Dendreo, and ruby_local_storage. The specific versions affected for git_credential_manager include 2.8.0, 2.8.1, 2.8.2, and 2.8.3, with its publication date listed as July 18, 2026. Dendreo versions 1.1.3 and 1.1.4 are also implicated. The third malicious gem, ruby_local_storage, had versions 0.1.0 and 0.1.1 published on July 18, 2026. The researchers noted that these gems were designed to mimic legitimate packages, a common tactic in supply chain attacks to evade detection. Upon installation, these malicious gems could potentially execute arbitrary code, steal sensitive information, or install further malware, thereby compromising the security of development environments. The discovery highlights ongoing threats within the open-source software supply chain, where the integrity of widely used packages is crucial for overall system security. Developers are advised to review their dependencies and ensure they are using trusted sources and up-to-date, legitimate versions of their software packages. The researchers did not immediately disclose the exact nature of the payloads delivered by SleeperGem, but the intent is clearly to gain unauthorized access and control over developer systems. This incident underscores the persistent need for vigilance and robust security practices in software development.