SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines

What’s new: A new software supply chain attack, codenamed SleeperGem, has been identified targeting the Ruby ecosystem. Three malicious RubyGems packages were published: git_credential_manager (versions 2.8.0 to 2.8.3), Dendreo (versions 1.1.3, 1.1.4), and fastlane-plugin-run_tests_firebase_testlab (version 0.3.2). These packages act as loaders that fetch and execute additional payloads on developer machines, while avoiding detection on CI/CD environments.

Who’s affected

Developers and organizations using the affected RubyGems packages, particularly those who have installed any of the malicious versions, are at risk. The attack exploits dormant accounts to publish malicious updates, potentially compromising developer machines and associated secrets.

What to do

• Remove the malicious gems and any associated daemons located at “~/.local/share/gcm/”.
• Erase persistence methods established by the malware.
• Check for a setuid shell at “/usr/local/sbin/ping6”.
• Rotate all credentials that may have been exposed.

Sources

• The Hacker News