SleeperGem: Malicious RubyGems Package Targets Developer Environments

A supply chain attack named SleeperGem has been identified targeting the RubyGems ecosystem, exploiting dormant maintainer accounts to publish a malicious gem called git_credential_manager. This gem, which has already been downloaded over 574,000 times, retrieves binaries from a self-hosted git server with SSL verification disabled and executes them on developer machines. The attack specifically avoids continuous integration environments, indicating a focus on compromising developer endpoints. The malicious gem was designed to spread by being added as a dependency to other packages, amplifying its reach. The incident raises significant concerns about trust in open source software distribution and the systemic risks posed by dependency compromises. Security researchers are urging developers to be vigilant and review their dependencies for potential threats.

Key Points: • A supply chain attack named SleeperGem targets RubyGems with a malicious gem. • The malicious gem has over 574,000 downloads and executes binaries with SSL verification disabled. • The attack specifically avoids CI environments, focusing on developer machines.