SleeperGem Supply Chain Attack — RubyGems Detection and Remediation

Defenders need to act immediately against a new software supply chain attack dubbed "SleeperGem." Security researchers have identified active malicious activity within the RubyGems repository, specifically targeting developer machines. The attack involves the publication of weaponized Ruby packages designed to blend in with legitimate development tools while serving arbitrary malicious code. This is not a theoretical vulnerability; it is an active compromise of the build pipeline that requires immediate inventory scanning and containment.

Technical Analysis

Threat Overview: The SleeperGem campaign leverages the trust developers place in the RubyGems package manager. Attackers have published packages with names mimicking legitimate utilities or specific project dependencies. Once installed, these gems execute code intended to compromise the developer's environment, potentially facilitating credential theft, lateral movement, or the establishment of a persistence mechanism within the development infrastructure.

Affected Artifacts: Based on current intelligence, the following malicious packages have been identified:

1. Package: git_credential_manager

   • Malicious Versions: 2.8.0, 2.8.1, 2.8.2, 2.8.3
   • Published: July 18, 2026
   • Note: This package attempts to impersonate the legitimate Git Credential Manager, a tool widely used for authenticating with Git repositories like GitHub and Azure DevOps. The existence of a RubyGem with this name is highly suspicious.

2. Package: Dendreo

   • Malicious Versions: 1.1.3, 1.1.4
   • Context: While less common, the inclusion of this package suggests a broader campaign targeting specific developer workflows or typosquatting a legitimate library.

Attack Chain:

1. Initial Compromise: A developer or build system runs gem install [package_name] for one of the malicious versions.
2. Execution: During the installation process, Ruby executes the gem's setup code (e.g., post_install hook or gemspec requirements).
3. Payload Delivery: The malicious code reaches out to a command-and-control (C2) infrastructure or executes a hidden shell command to download and execute a secondary payload, giving the attacker control over the host.

Exploitation Status: Active exploitation has been confirmed. These packages are currently live on the repository (or were recently removed but remain cached in local environments).

Detection & Response

The following detection mechanisms focus on the installation of these specific artifacts and the execution of Ruby processes involving these package names.

Sigma Rules

---
title: Potential Installation of Malicious SleeperGem RubyGems
id: 8a4b2c1d-6e9f-4a3b-8c5d-1e2f3a4b5c6d
status: experimental
description: Detects the installation of known malicious RubyGems associated with the SleeperGem campaign (git_credential_manager, Dendreo).
references:
  - https://thehackernews.com/2026/07/sleepergem-uses-three-malicious.html
author: Security Arsenal
date: 2026/07/18
tags:
  - attack.initial_access
  - attack.t1195.002
logsource:
  category: process_creation
  product: linux
detection:
  selection_gem:
    Image|endswith: '/gem'
    CommandLine|contains: 'install'
  selection_malicious:
    CommandLine|contains:
      - 'git_credential_manager'
      - 'Dendreo'
  condition: all of selection_*
falsepositives:
  - Legitimate installation of a similarly named internal package (unlikely for git_credential_manager)
level: critical
---
title: Execution of Malicious RubyGems Code
id: 9b5c3d2e-7f0a-5b4c-9d6e-2f3g4h5i6j7k
status: experimental
description: Detects Ruby processes executing code from directories associated with the malicious SleeperGem packages.
references:
  - https://thehackernews.com/2026/07/sleepergem-uses-three-malicious.html
author: Security Arsenal
date: 2026/07/18
tags:
  - attack.execution
  - attack.t1059.006
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: '/ruby'
    CommandLine|contains:
      - 'git_credential_manager'
      - 'Dendreo'
  condition: selection
falsepositives:
  - Legitimate developer testing of these specific package names
level: high

KQL (Microsoft Sentinel / Defender)

This query hunts for process creation events indicating the installation of the malicious packages.

DeviceProcessEvents
| where Timestamp > datetime(2026-07-18)
| where FileName has "gem" 
| where ProcessCommandLine has "install" 
| where ProcessCommandLine has_any ("git_credential_manager", "Dendreo")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName

Velociraptor VQL

Hunt for the presence of the malicious gem directories on the endpoint filesystem.

-- Hunt for SleeperGem malicious package directories
SELECT FullPath, Size, Mtime
FROM glob(globs='/var/lib/gems/*/gems/git_credential_manager-*')
WHERE FullPath =~ '2\.8\.[0-3]'

UNION ALL

SELECT FullPath, Size, Mtime
FROM glob(globs='/var/lib/gems/*/gems/Dendreo-*')
WHERE FullPath =~ '1\.1\.[34]'

Remediation Script (Bash)

Use this script to audit and remove the malicious packages from Linux or macOS environments.

#!/bin/bash

# Remediation Script for SleeperGem Malicious RubyGems
# Author: Security Arsenal
# Date: 2026-07-18

echo "[*] Starting audit for SleeperGem malicious packages..."

# Function to remove package if found
remove_gem() {
  local package_name=$1
  local versions="$2"
  
  # Check if package is installed
  installed_versions=$(gem list "$package_name" --local --exact 2>/dev/null | grep -E "\($versions\)")
  
  if [ ! -z "$installed_versions" ]; then
    echo "[!] MALICIOUS PACKAGE FOUND: $package_name"
    echo "[+] Attempting to uninstall all versions of $package_name..."
    gem uninstall "$package_name" -a -x -I
    if [ $? -eq 0 ]; then
      echo "[+] Successfully removed $package_name."
    else
      echo "[-] Error removing $package_name. Please check permissions."
    fi
  else
    echo "[+] No malicious version of $package_name found."
  fi
}

# Audit git_credential_manager (versions 2.8.0 - 2.8.3)
remove_gem "git_credential_manager" "2.8\.[0-3]"

# Audit Dendreo (versions 1.1.3, 1.1.4)
remove_gem "Dendreo" "1.1\.(3|4)"

echo "[*] Audit complete. Please review Gemfile.lock for any references to these packages."

Remediation

1. Immediate Removal: Run the remediation script above or manually execute gem uninstall for the affected versions on all developer workstations and build agents.

   • gem uninstall git_credential_manager -v '2.8.0'
   • gem uninstall git_credential_manager -v '2.8.1'
   • gem uninstall git_credential_manager -v '2.8.2'
   • gem uninstall git_credential_manager -v '2.8.3'
   • gem uninstall Dendreo -v '1.1.3'
   • gem uninstall Dendreo -v '1.1.4'

2. Audit Gemfile.lock: Search source code repositories and CI/CD pipelines for references to these specific package versions. If found, update the Gemfile to point to the legitimate, verified library (if git_credential_manager was actually needed, which is unlikely as a RubyGem) or remove the dependency entirely.

3. Supply Chain Policy: Enforce strict supply chain security policies immediately.

   • Private Registries: Block direct installation from the public RubyGems.org repository for internal projects. Use a private proxy (e.g., Artifactory, Nexus) that allows you to quarantine and review new packages.
   • Checksum Verification: Ensure Gemfile.lock is checked into version control and verified during builds to prevent package substitution.
   • Developer Hygiene: Remind development teams never to install packages that mimic system binaries (like git_credential_manager) unless explicitly verified from a trusted source.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub