SleeperGem Supply-Chain Attack Exposed: Hijacked Dormant RubyGems Accounts Poison Developer Machines

Attackers hijacked long-dormant RubyGems maintainer accounts, published malicious gems built to bypass CI detection, and installed persistent backdoors on developer machines. The fastlane plugin has 574k+ historical downloads.

Incident Overview

On 18–19 July 2026, researchers identified a coordinated supply-chain attack against the RubyGems ecosystem, named SleeperGem. Attackers hijacked long-dormant RubyGems maintainer accounts and published three malicious gems designed to install persistent backdoors on developer machines while actively avoiding CI/CD pipeline environments.

StepSecurity and Aikido Security independently discovered and reported the attack. Affected packages include git_credential_manager (impersonating Microsoft Git Credential Manager), Dendreo (dormant ~6 years), and the fastlane plugin fastlane-plugin-run_tests_firebase_testlab — the last with 574k+ historical downloads.

Technical Details

Malicious Package Inventory

| Package | Malicious versions | Characteristics | |---|---|---| | git_credential_manager | 2.8.0–2.8.3 | Impersonates Microsoft official tool; import-time trigger from 2.8.2 | | Dendreo | 1.1.3, 1.1.4 | Dormant since 2020; no corresponding GitHub commits | | fastlane-plugin-run_tests_firebase_testlab | 0.3.2 | No corresponding GitHub tag; upstream tags stop at v0.3.1 |

CI Environment Evasion

SleeperGem's most distinctive trait is active CI/CD evasion. Before trigger, the malicious code checks ~30 CI platform environment variables, including GitHub Actions, GitLab CI, CircleCI, Travis, Jenkins, Vercel, and others. Any CI marker causes immediate exit with no malicious behavior.

Tactical intent:

• CI runner: short-lived, log-dense, typically destroyed after the job — poor for persistence, high detection probability
• Developer laptop: long-lived, holds SSH keys and cloud credentials, direct private-repo access, weaker security monitoring

Traditional models that scan dependencies only in CI fail completely against this attack.

Attack Flow and Persistence

After confirming it is running on a developer machine, the malicious gem:

• Downloads stage 2: Ruby built-in HTTP client (TLS certificate verification disabled) fetches a shell script and native binary from an attacker-controlled Forgejo host
• User-Agent spoofing: HTTP User-Agent set to Git, blending into normal Git traffic
• Installs a daemon: drops a native daemon under ~/.local/share/gcm/
• Persistence: systemd user service and cron jobs survive reboot
• Privilege escalation: on passwordless sudo systems, creates a setuid root shell disguised as /usr/local/sbin/ping6

Impact Assessment

SleeperGem's pattern exposes a new supply-chain threat dimension:

• Dormant-account weaponization: long-inactive maintainer accounts reactivated to distribute malware; registries lack effective monitoring
• CI blind-spot abuse: specifically targets developer workstations outside most enterprise-instrumented CI environments
• Wide exposure: 570k+ historical downloads of the fastlane plugin imply potential impact across many mobile development teams
• Multi-account compromise: affected packages belong to different maintainer accounts, indicating at least two independent account takeovers

Remediation

Emergency Response (if an affected version was installed)

StepSecurity: uninstalling the gem is not sufficient. If an affected version was installed, perform the following cleanup:

• Rotate all credentials immediately: SSH keys, cloud access keys, Kubernetes credentials, GitHub/GitLab tokens
• Delete directory: rm -rf ~/.local/share/gcm/
• Find and delete all mmcompat.pth files in site-packages
• Clean cron: crontab -l; remove entries pointing at the malicious binary
• Check systemd user services: systemctl --user list-units; remove suspicious units
• Inspect shell configs (~/.bashrc, ~/.zshrc); remove suspicious blocks
• Check for setuid /usr/local/sbin/ping6
• Treat the affected developer machine as fully compromised; re-image if necessary

Supply-Chain Hardening

• Rotate PyPI/RubyGems/npm publishing credentials on a schedule; enforce MFA
• Cross-validate dependency versions against source-repo release tags and commits
• Deploy SCA on both CI and developer machines
• Extra review for reactivation of long-dormant maintainer accounts
• Use a private registry or caching proxy to widen the detection window for malicious publishes

References

• StepSecurity: SleeperGem full attack-chain analysis
• CoderCops: SleeperGem developer-machine attack deep dive
• ThreatWiki: SleeperGem technical summary and IOCs
• iSec News: Malicious Ruby Gems and the SleeperGem supply-chain attack