SleeperGem Attack Targets Ruby Developers with Compromised Packages
A new supply chain attack dubbed SleeperGem has compromised three RubyGems packages, including one impersonating Microsoft's Git Credential Manager, to deliver malware to developer machines.
A sophisticated supply chain attack, identified as SleeperGem, is targeting the Ruby developer ecosystem through the distribution of malicious packages on RubyGems. Researchers have uncovered three rogue gems: git_credential_manager (versions 2.8.0-2.8.3), Dendreo (versions 1.1.3-1.1.4), and fastlane-plugin-run_tests_firebase_testlab (version 0.3.2). These packages were published with the intent of delivering further malicious payloads to unsuspecting developers.
The git_credential_manager gem is particularly insidious as it impersonates Microsoft's legitimate Git Credential Manager. Adding to the stealth, the Dendreo and fastlane-plugin-run_tests_firebase_testlab gems, while updated recently with malicious code, had been dormant for years, making their sudden resurgence with malicious intent less likely to raise immediate suspicion. A defining characteristic of this attack is that the malicious releases were pushed directly to the RubyGems registry without corresponding commits or tags in the official source code repositories, a common tactic to obscure malicious activity.
Adding to the potential reach of this attack, the compromised git_credential_manager gem was listed as a dependency in five other packages, including Dendreo and fastlane-plugin-run_tests_firebase_testlab. This dependency chain means that users of these legitimate packages could inadvertently install the malicious code. The affected packages include Dendreo, fastlane-plugin-run_tests_firebase_testlab, slackHtmlToMarkdown, seo_optimizer, and array_fast_methods. Notably, most of these packages are maintained by the same account, 'LR-DEV', but the inclusion of fastlane-plugin-run_tests_firebase_testlab from a different maintainer, 'pinkroom', suggests that multiple accounts may have been compromised to facilitate this campaign.
Once installed, the malware embedded within these gems performs a crucial check to evade detection in automated environments. It scans for approximately 30 environment variables associated with popular CI/CD platforms such as GitHub Actions, GitLab, CircleCI, Travis, Jenkins, and Vercel. If any of these are detected, the malware terminates its execution, indicating a deliberate effort to target developer workstations rather than build servers.
For the git_credential_manager gem, the malicious code is triggered upon requiring the library. It then downloads two payloads from a compromised Forgejo instance: a shell script named deploy.sh and a native binary. On Windows systems, this payload is executed via PowerShell. Version 2.8.2 of the gem focuses on staging these payloads, while version 2.8.3 escalates the attack by using the installation script to deploy the binary as a background daemon. This daemon establishes persistence through cron jobs and systemd user services, and it actively queries sudo and wheel groups.
In a critical escalation, if the user has passwordless sudo privileges, the script re-executes itself with root privileges. In this elevated state, it installs a setuid root copy of the system shell, disguised as a networking utility, at a location like /usr/local/sbin/ping6. This allows the attacker to maintain privileged access and execute commands as root on the compromised system.
Researchers are advising users who may have installed any of the affected gems to consider their machines and any associated secrets compromised. Recommended remediation steps include removing the dropped daemon located at ~/.local/share/gcm/, eradicating persistence mechanisms, checking for the presence of the malicious setuid shell, and rotating all sensitive credentials. The name 'SleeperGem' aptly describes the attack's methodology, leveraging dormant accounts that appear harmless to hijack and use for malicious purposes without immediate detection.
This incident adds to a growing trend of supply chain attacks targeting open-source repositories. RubyGems, in particular, has seen multiple such campaigns recently. Just months prior, dozens of malicious packages were discovered in a coordinated spam-publishing effort, and another campaign used gems as a 'dead drop' for exfiltrated data. These events underscore the persistent risks within the software supply chain and the need for enhanced security measures for package registries and developer tools.