Three gems on RubyGems.org are actively backdooring developer machines — and one of them impersonates Microsoft’s own Git Credential Manager. The attack, named SleeperGem by researchers at StepSecurity, exploits a blind spot most Ruby developers have: it executes when you require the gem in code, not when you install it. It also deliberately avoids CI/CD runners and targets only your local machine — the one storing SSH keys, AWS credentials, and production secrets.
The Three Packages
The campaign centers on three gems published or updated between July 18–20, 2026:
- git_credential_manager (v2.8.0–2.8.3) — A newly created fake, published July 18, impersonating Microsoft’s official credential manager tool. No legitimate gem by this name existed before.
- Dendreo (v1.1.3–1.1.4) — A real gem that had been dormant since 2017. Attackers compromised the original maintainer’s account, which had sat idle for six or seven years.
- fastlane-plugin-run_tests_firebase_testlab (v0.3.2) — Another legitimate gem, last updated in 2019, with 574,661 total downloads. Same playbook: hijacked dormant account, poisoned update.
The trick is in the dependency chain. Attackers added git_credential_manager as a dependency of both Dendreo and the fastlane plugin, meaning users who already trusted those older gems silently inherited the malware on their next bundle update.
How It Works: Targeting You, Not Your CI
The sophistication here is in what the malware doesn’t do. On execution, it scans for roughly 30 environment variables tied to CI/CD platforms — GITHUB_ACTIONS, GITLAB_CI, CIRCLECI, TRAVIS, JENKINS, VERCEL, and more. Detect one of those? It exits immediately and leaves no trace.
Attackers don’t want ephemeral CI containers. They want your developer machine.
If it lands on a dev box, the attack chains through four stages: download a shell script (deploy.sh) and a native binary from an attacker-controlled Forgejo instance, install a background daemon at ~/.local/share/gcm/, establish persistence via both a cron entry and a systemd user service, then probe for sudo access. If it finds passwordless sudo, it plants a setuid root shell at /usr/local/sbin/ping6 with permissions 6777 — a clean path to full system control.
The version history tells the development story. Version 2.8.0 was the working dropper. Version 2.8.1 silenced output. Version 2.8.2 staged payloads but held back execution. Version 2.8.3 removed the safety comments and went live.
Why “SleeperGem”?
The name comes from a strategic insight researchers found impressive in its cynicism. As Charlie Eriksen of Aikido Security put it: “A RubyGems account dormant for six or seven years doesn’t look risky to anyone — which is exactly the profile worth taking over.”
A recently registered gem gets scrutiny. A gem published by an account that’s been around for a decade and hasn’t done anything suspicious in years? That gets a pass. RubyGems doesn’t require 2FA for publishing — a gap GitHub already closed for npm in 2023. The dormant account tactic isn’t going away until registries force maintainers to re-verify.
Are You Affected?
Check your environment now:
# Check if the affected gems are installed
gem list git_credential_manager
gem list dendreo
gem list fastlane-plugin-run_tests_firebase_testlab
# Look for the dropped daemon
ls ~/.local/share/gcm/
# Check for a setuid shell (indicates root-level compromise)
ls -la /usr/local/sbin/ping6
# Check for cron persistence
crontab -l | grep -i gcm
# Check systemd user service
systemctl --user list-units | grep git-credential-managerIf any of those checks come back positive, assume the machine and every credential accessible from it are compromised.
Remediation Steps
StepSecurity’s guidance is unambiguous:
- Remove the daemon:
rm -rf ~/.local/share/gcm/ - Remove cron persistence: edit
crontab -eand delete any git-credential-manager entries - Remove the systemd service:
systemctl --user disable --now git-credential-manager - Check for and remove the setuid shell:
rm /usr/local/sbin/ping6if it exists - Rotate all credentials — SSH keys, AWS keys, API tokens, git tokens. Every single one.
This Is Not a One-Off
SleeperGem didn’t arrive in isolation. In May 2026, researchers at Mend.io found 14 RubyGems packages being used as a data dead-drop: gems containing no code, just exfiltrated 1Password vault contents — passwords, SSH keys, AWS credentials, SSNs. RubyGems paused new account signups that month. It didn’t stop this.
Across all registries in 2026, security researchers have tracked 59 supply chain attack campaigns with 657 malicious packages — generating zero CVEs, because there’s no vendor to assign a CVE to. Traditional patching doesn’t work here. The attack surface is the trust model itself.
RubyGems should implement mandatory 2FA for publishing, a dead account reaper for maintainers inactive more than three years, and native registry-level monitoring. Until then, the safest posture is what StepSecurity recommends for any open-source ecosystem: pin your dependencies, monitor for unexpected new versions on dormant packages, and treat any unmaintained gem in your dependency tree as a liability. You can follow ongoing supply chain attack coverage at The Hacker News.
