Researchers uncovered a software supply chain attack targeting Ruby developers after three malicious packages appeared on RubyGems, the official package repository. The attack, tracked as SleeperGem, distributed gems designed to execute arbitrary code on developer machines and deliver additional payloads.
The three compromised packages were git_credential_manager (versions 2.8.0 through 2.8.3), Dendreo (versions 1.1.3 and 1.1.4), and a third unnamed package. The git_credential_manager gem mimicked legitimate functionality while concealing malicious code that executed during installation or use. Attackers published the poisoned packages to the public RubyGems repository, where developers could unknowingly download them as dependencies.
The attack exploited the trust developers place in open source ecosystems. Because Ruby projects frequently depend on dozens of gems, developers often install packages without auditing their contents. The malicious gems remained undetected long enough to reach multiple systems before RubyGems removed them.
The payloads delivered by SleeperGem remain undisclosed in available reports, but such attacks typically exfiltrate credentials, inject backdoors, or establish persistence mechanisms on compromised development machines. A single infected developer system can expose entire organizations to lateral movement and data theft.
RubyGems maintainers removed the malicious packages, but determining the full scope of installations proved difficult. Anyone who installed affected versions before removal faces potential compromise. Organizations using these packages in production or development environments should audit their systems immediately.
This incident reflects recurring vulnerabilities in package management ecosystems across Node.js, Python, and Ruby. Attackers recognize that poisoning widely used dependencies reaches thousands of machines with minimal effort. Defenders should implement dependency scanning tools, pin package versions to specific hashes, and review gem updates before deploying to