SleeperGem: Malicious RubyGems Package Targets Developer Environments

Tipranks

SleeperGem: Malicious RubyGems Package Targets Developer Environments

First seen 20 Jul 2026, 05:15 UTC • •67.5

Article Content

1 / 4

Browse articles

ThreatCluster •July 21, 2026 at 03:08 UTC

•A supply chain attack named SleeperGem targets RubyGems with a malicious gem.
•The malicious gem has over 574,000 downloads and executes binaries with SSL verification disabled.
•The attack specifically avoids CI environments, focusing on developer machines.

A supply chain attack named SleeperGem has been identified targeting the RubyGems ecosystem, exploiting dormant maintainer accounts to publish a malicious gem called git_credential_manager. This gem, which has already been downloaded over 574,000 times, retrieves binaries from a self-hosted git server with SSL verification disabled and executes them on developer machines. The attack specifically avoids continuous integration environments, indicating a focus on compromising developer endpoints. The malicious gem was designed to spread by being added as a dependency to other packages, amplifying its reach. The incident raises significant concerns about trust in open source software distribution and the systemic risks posed by dependency compromises. Security researchers are urging developers to be vigilant and review their dependencies for potential threats.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 98d ago How this analysis works

Timeline

2026-07-19

Malicious gem discovered

A suspicious package named git_credential_manager was found in the RubyGems triage queue, leading to further investigation.

2026-07-19

Malicious gem published

The git_credential_manager gem was published in four versions, with the first version functioning as a dropper for malicious binaries.

2026-07-19

Attack method detailed

The gem was found to bypass CI environments and execute downloaded binaries directly on developer endpoints.

2026-07-19

Dependency spread confirmed

The malicious gem was added as a dependency to other existing packages, allowing it to spread further.

More articles in this cluster (3)

Threat Graph

22 entities, 41 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (8)

Malware
Supply Chain Attack
T1053 - Scheduled Task/Job
T1059.001 - PowerShell
T1068 - Exploitation for Privilege Escalation
T1105 - Ingress Tool Transfer
T1195 - Supply Chain Compromise
T1543.003 - Windows Service

Campaign (1)

SleeperGem

Organization (2)

Forgejo
Vercel

Affected Platform (7)

CircleCI
Gitlab
GitLab CI
Jenkins
RubyGems
Systemd
Travis CI

Tool (4)

Cron
GitHub Actions
Git Credential Manager
PowerShell

Relationships

Malware targets CircleCI
Malware targets Gitlab
Malware targets GitLab CI
Malware targets Jenkins
Supply Chain Attack targets CircleCI
Supply Chain Attack targets Gitlab
Supply Chain Attack targets GitLab CI
Supply Chain Attack targets Jenkins
T1053 - Scheduled Task/Job targets CircleCI
T1053 - Scheduled Task/Job targets Gitlab
T1053 - Scheduled Task/Job targets GitLab CI
T1053 - Scheduled Task/Job targets Jenkins
T1059.001 - PowerShell targets CircleCI
T1059.001 - PowerShell targets Gitlab
T1059.001 - PowerShell targets GitLab CI
T1059.001 - PowerShell targets Jenkins
T1068 - Exploitation for Privilege Escalation targets CircleCI
T1068 - Exploitation for Privilege Escalation targets Gitlab
T1068 - Exploitation for Privilege Escalation targets GitLab CI
T1068 - Exploitation for Privilege Escalation targets Jenkins
T1105 - Ingress Tool Transfer targets CircleCI
T1105 - Ingress Tool Transfer targets Gitlab
T1105 - Ingress Tool Transfer targets GitLab CI
T1105 - Ingress Tool Transfer targets Jenkins
T1195 - Supply Chain Compromise targets CircleCI
T1195 - Supply Chain Compromise targets Gitlab
T1195 - Supply Chain Compromise targets GitLab CI
T1195 - Supply Chain Compromise targets Jenkins
T1543.003 - Windows Service targets CircleCI
T1543.003 - Windows Service targets Gitlab
T1543.003 - Windows Service targets GitLab CI
T1543.003 - Windows Service targets Jenkins
SleeperGem related to Forgejo
SleeperGem related to Vercel
SleeperGem related to RubyGems
SleeperGem related to Systemd
SleeperGem related to Travis CI
SleeperGem related to Cron
SleeperGem related to GitHub Actions
SleeperGem related to Git Credential Manager
SleeperGem related to PowerShell

Following this threat?

Track Forgejo in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…

PHP2Shell Vulnerabilities Exploited by AI-Driven Attackers Threat actors have exploited PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) to target a government entity in Europe, gaining access to sensitive data within two hours of the initial breach. The attackers utilized AI tools for reconnaissance and post-exploitation activities, including accessing…