SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines
A new software supply chain attack, dubbed SleeperGem, has been identified targeting the Ruby ecosystem through three malicious RubyGems packages designed to infect developer machines.
Intelligence analysis by Gemini 2.5 Flash
Cybersecurity researchers have uncovered SleeperGem, an attack leveraging compromised or impersonated RubyGems to deliver a multi-stage payload. The malicious gems, including one mimicking Microsoft's Git Credential Manager, install a persistent daemon on developer systems while actively avoiding detection in build environments.
Imagine a sneaky trick where someone puts a bad toy in a big box of building blocks that many kids use. This bad toy looks like a normal one, but when a kid takes it home and plays with it on their special computer, it secretly installs a hidden spy program. It's smart enough to know if it's on a school computer (where it hides) or a kid's personal computer (where it works), and then it tries to get special powers on that computer to steal secrets.
Analysis
The Deceptive Delivery
The SleeperGem attack demonstrates a sophisticated approach to software supply chain compromise, primarily by injecting malicious code into the RubyGems ecosystem. The attackers utilized three specific gems: git_credential_manager, Dendreo, and fastlane-plugin-run_tests_firebase_testlab. A key aspect of this operation is the impersonation of legitimate tools, as seen with git_credential_manager mimicking Microsoft's official Git Credential Manager. This tactic leverages trust and familiarity to trick developers into installing the rogue packages.
Furthermore, the attackers exploited dormant, older gems like Dendreo and fastlane-plugin-run_tests_firebase_testlab by pushing malicious updates to them after years of inactivity. This strategy, as noted by Aikido Security researcher Charlie Eriksen, makes the compromised accounts appear less risky, allowing the malicious updates to go unnoticed. The direct publication of these releases to the registry without corresponding commits in source projects further indicates a deliberate attempt to bypass standard security checks and maintain stealth.
Evasion and Escalation
Once installed, the SleeperGem malware employs clever evasion techniques to ensure it targets the intended victims: developer machines. It scans for approximately 30 environment variables associated with continuous integration (CI) systems like GitHub Actions, GitLab, and Jenkins. If any are detected, the malware promptly exits, preventing execution on ephemeral CI runners and focusing its efforts on more persistent developer environments. This selective execution is crucial for the attackers to establish long-term presence and avoid detection by automated security scans often present in CI/CD pipelines.
The malicious code, particularly in git_credential_manager, downloads a shell script and a native binary from a Forgejo instance. On Windows systems, the payload is executed via PowerShell. The attack escalates by establishing persistence through cron entries and systemd user services. Critically, if the user can run sudo without a password, the script re-runs as root, planting a setuid root copy of the system shell at a path designed to mimic a networking utility, thereby granting the attackers root-level access and control over the compromised system.
A Broader Threat to Open Source
The SleeperGem incident is not an isolated event but rather part of a growing trend of attacks targeting open-source software supply chains, particularly within the RubyGems ecosystem. The disclosure follows recent campaigns where bad actors flooded the registry with malicious packages for spam or used gems as data exfiltration channels. Notably, a previous attack involved a malicious browser extension harvesting credentials and uploading them as .gem files to RubyGems.org, effectively using the platform as a 'dead drop' for stolen data.
These incidents underscore the significant challenges in securing open-source repositories, where the integrity of packages can be compromised through various means, including account takeovers and the exploitation of trust. The reliance on community-maintained packages and the sheer volume of uploads make it difficult to vet every component. Developers are advised to treat compromised machines and associated secrets as fully compromised, emphasizing the need for rigorous security practices, including credential rotation and thorough system hygiene, to mitigate the risks posed by such sophisticated supply chain attacks.
Key points
- SleeperGem is a new software supply chain attack targeting the Ruby ecosystem via three malicious RubyGems packages.
- The attack uses gems like `git_credential_manager` (impersonating a Microsoft tool) and updates to dormant packages (`Dendreo`, `fastlane-plugin-run_tests_firebase_testlab`).
- The malware avoids CI/CD environments by checking for specific environment variables, ensuring it only runs on developer machines.
- It establishes persistence via cron entries and systemd services, escalating privileges to root if possible to plant a setuid shell.
- Users who installed the affected gems are advised to consider their machines compromised, remove the malware, and rotate all credentials.
The rapid detection and public disclosure of the SleeperGem attack by security researchers can lead to increased awareness among developers and organizations, prompting them to audit their dependencies and implement stronger supply chain security measures. This vigilance could help prevent future similar attacks from gaining widespread traction.
The continued success of such sophisticated supply chain attacks, especially those exploiting dormant accounts and evading CI/CD checks, suggests that many developer machines and associated credentials remain vulnerable. This could lead to widespread compromise of development environments, potentially impacting numerous downstream applications and users.
