SleeperGem Uses Three RubyGems to Compromise Dev Machines
Security researchers uncovered SleeperGem, a three-package RubyGems supply-chain attack: git_credential_manager, Dendreo, and fastlane-plugin-run_tests_firebase_testlab were repackaged as loaders that fetch a second-stage payload from a Forgejo host; the malware avoids CI environments, drops a native daemon on developer machines, installs persistence via cron and a systemd user service, and can even plant a setuid root shell at /usr/local/sbin/ping6 if sudo is passwordless. The rogue gems spread by being added as dependencies to other gems. Remediation includes removing the dropped daemon from ~/.local/share/gcm/, erasing persistence mechanisms, and rotating credentials.