SleeperGem: Hijacked Dormant RubyGems Maintainer Accounts Used to Inject Payload-Dropping Loaders Targeting Developer Endpoints

Aikido Security and StepSecurity disclosed SleeperGem, a RubyGems supply chain attack in which adversaries reactivated two long-dormant maintainer accounts to poison three packages — including git_credential_manager (impersonating Microsoft's official tool) and fastlane-plugin-run_tests_firebase_testlab (574,000+ total downloads). Each malicious release acts as a loader that checks for CI/CD environments and skips them, exclusively targeting developer machines where it drops a native daemon, installs cron and systemd persistence, and escalates to root if sudo is passwordless. The attack surface is developer endpoints — precisely the instrumentation gap left by years of pipeline-focused hardening.

The attack surface is developer endpoints — precisely the instrumentation gap left by years of pipeline-focused hardening.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.