SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines
SleeperGem is a sophisticated supply chain attack targeting the Ruby ecosystem via three malicious gems: git_credential_manager, Dendreo, and fastlane-plugin-run_tests_firebase_testlab. Attackers hijacked dormant accounts and impersonated legitimate tools to deliver loaders that fetch secondary payloads from attacker-controlled Forgejo hosts. The malware specifically avoids CI/CD environments by detecting ephemeral runner variables, ensuring execution only on developer machines for persistent ac
Analysis
TL;DR
- SleeperGem is a sophisticated supply chain attack targeting the Ruby ecosystem via three malicious gems: git_credential_manager, Dendreo, and fastlane-plugin-run_tests_firebase_testlab.
- Attackers hijacked dormant accounts and impersonated legitimate tools to deliver loaders that fetch secondary payloads from attacker-controlled Forgejo hosts.
- The malware specifically avoids CI/CD environments by detecting ephemeral runner variables, ensuring execution only on developer machines for persistent access.
- Advanced persistence mechanisms include installing native daemons, creating systemd services, and exploiting passwordless sudo to plant a setuid root shell.
- RubyGems is increasingly exploited not just for malware delivery but as a data exfiltration dead drop, highlighting broader risks in package registries.
Why It Matters
This incident demonstrates how attackers leverage trust in established package ecosystems and dormant accounts to bypass security scrutiny, making traditional vigilance insufficient. It highlights the critical need for developers to verify package provenance and monitor for unexpected network connections or file system changes during installation. Furthermore, it underscores the evolving threat landscape where package registries serve dual purposes for both code injection and data theft, requiring comprehensive supply chain security strategies.
Technical Details
- Malicious Packages: The attack utilizes
git_credential_manager(impersonating Microsoft's official tool),Dendreo, andfastlane-plugin-run_tests_firebase_testlab. These were published with versions that had no corresponding commits in their source repositories. - Evasion Logic: The initial loader checks for approximately 30 environment variables associated with CI/CD platforms (GitHub Actions, GitLab, Jenkins, etc.). If detected, the process exits immediately to avoid detection in ephemeral environments.
- Payload Delivery: Upon confirming a local developer environment, the malware downloads a shell script (
deploy.sh) and a native binary fromgit.disroot[.]org/git-ecosystem. Version 2.8.3 ofgit_credential_managerexecutes these to establish persistence via cron jobs and systemd user services. - Privilege Escalation: If the user has passwordless sudo privileges, the script escalates to root and installs a setuid copy of the system shell at
/usr/local/sbin/ping6to mimic a networking utility. - Data Exfiltration Context: Parallel campaigns have used RubyGems as a "dead drop" for stolen credentials (AWS keys, SSH keys, passwords) by packaging them as
.gemfiles and uploading them via compromised browser extensions, leveraging the registry's high traffic to hide malicious uploads.
Industry Insight
- Account Hygiene is Critical: Dormant accounts are prime targets for takeover because they attract less scrutiny. Maintainers must secure their accounts with MFA and regularly audit permissions, even for inactive projects.
- Supply Chain Verification: Organizations should implement strict policies requiring verification of package signatures and source code alignment before installation, especially for widely used dependencies like credential managers.
- Monitoring for Anomalies: Security teams should monitor for unusual outbound network connections from development machines and unexpected file creations in system directories (e.g.,
/usr/local/sbin) to detect early-stage compromise.
Disclaimer: The above content is generated by AI and is for reference only.