Cybersecurity researchers have flagged a new software supply chain attack codenamed SleeperGem targeting the Ruby ecosystem after three malicious gems were published to RubyGems with the end goal of serving additional payloads.
The rogue gems are listed below –
“Each malicious release is a loader,” StepSecurity said in an analysis. “It fetches a second stage from an attacker controlled Forgejo host, checks whether it is running in a build system and skips if it is, and on a developer machine it drops a native daemon and installs persistence.”
One aspect of the attack that immediately stands out is that “git_credential_manager” impersonates the official Microsoft Git Credential Manager, while the other two had been dormant for years before receiving the malicious updates. “Dendreo” was last updated on October 24, 2020, and “fastlane-plugin-run_tests_firebase_testlab” stayed inactive since March 9, 2019, prior to the new versions.
Another defining trait of the activity is that the releases were published directly to the registry without any matching commit or tag in the source projects.
Interestingly, “git_credential_manager” has been added as a dependency to five packages, including “Dendreo” and “fastlane-plugin-run_tests_firebase_testlab,” effectively allowing the malicious payload to spread to existing users of the packages –
- Dendreo
- fastlane-plugin-run_tests_firebase_testlab
- slackHtmlToMarkdown
- seo_optimizer
- array_fast_methods
All the aforementioned packages, with the exception of “fastlane-plugin-run_tests_firebase_testlab,” are maintained by the same account (“LR-DEV”). The fact that the gem belongs to a different maintainer (“pinkroom”) indicates that more than one account was likely compromised to push the rogue versions to RubyGems.
Once installed, the malware embedded in these packages scans the infected system for about 30 environment variables, including those related to GitHub Actions, GitLab, CircleCI, Travis, Jenkins, and Vercel. If any of those are identified, it promptly exits. The check is assessed to be an intentional attempt to avoid running on ephemeral CI runners and ensure it’s executed on a developer machine.
In the case of “git_credential_manager,” the malicious code is fired when the library is required, causing it to download two payloads from a public Forgejo instance (“git.disroot[.]org/git-ecosystem”): a shell script (“deploy.sh”) and a native binary that carries the same name as the tool the gem masquerades as. On Windows, the retrieved payload is executed via PowerShell.
While version 2.8.2 merely stages the payloads, version 2.8.3 of the gem moves to the next phase of the attack. This involves using the install script to launch the binary as a background daemon, after which it establishes persistence using a cron entry and as a systemd user service and queries the sudo and wheel groups.
“If the user can run sudo without a password, the script re-runs itself as root, and when it runs as root it plants a setuid root copy of the system shell at a path chosen to mimic a networking utility,” StepSecurity said.
Users who have installed any of the aforementioned gems are advised to treat the machines and associated secrets as compromised. It’s also recommended to remove the dropped daemon at “~/.local/share/gcm/,” erase the persistence methods, check for a setuid shell at “/usr/local/sbin/ping6,” and rotate all credentials.
“A RubyGems account that has gone quiet for six or seven years doesn’t look risky to anyone,” Aikido Security researcher Charlie Eriksen said. “That’s exactly the profile worth taking over. That’s where the SleeperGem name comes from: not a planted, long-game attacker asset, but a real, ordinary account that had simply gone dormant, and looked harmless enough to hijack without anyone noticing.”
RubyGems as a Data Exfiltration Dead Drop
The disclosure comes more than two months after RubyGems briefly paused account sign-ups after bad actors pushed dozens of malicious packages as part of a coordinated spam-publishing campaign. Around the same time, Socket researchers flagged a parallel campaign that flooded the registry with 150 gems that abused them as a data exfiltration channel.
Earlier this month, Mend.io disclosed details of an undocumented software supply chain attack that employed another set of 14 RubyGems packages to store stolen credential data.
Specifically, a malicious browser extension was found to have harvested credentials through a locally accessible API, packaged the information into valid .gem files entirely within the browser using JavaScript and standard Web APIs, and uploaded those packages directly to RubyGems.org using a hard-coded RubyGems API key.
“The haul included plaintext passwords, SSH private keys, AWS credentials, crypto wallet seed phrases, Social Security numbers, credit card numbers, and bank account details across 63 vault items,” Maciej Mensfeld said.
“RubyGems wasn’t the delivery mechanism here. It was the dead drop: a trusted, high-traffic domain where stolen data sat until the attacker came back for it, invisible among normal developer uploads.”
