SleeperGem: Poisoned Ruby Packages Found Lurking on the Official RubyGems Registry

Three booby-trapped Ruby packages were uploaded to RubyGems, the official package registry for the Ruby programming language, in a supply chain campaign researchers have named SleeperGem.

What Happened

The attack targets software developers directly. When a developer installs one of the compromised packages, the embedded code reaches out to an attacker-controlled server and fetches a secondary malicious payload. That two-stage design is deliberate: keeping the initial upload small and clean makes it harder for automated scanners to flag the package before it spreads.

Researchers identified three rogue packages in total. The most documented is `git_credential_manager`, published on July 18, 2026, across four consecutive versions: 2.8.0, 2.8.1, 2.8.2, and 2.8.3. A second package called `Dendreo` appeared in versions 1.1.3 and 1.1.4.

Why the Names Matter

Both names were chosen for plausibility. `git_credential_manager` directly mimics a legitimate, widely used tool that handles authentication for Git, the version-control system at the heart of most modern software development workflows. A developer searching for that tool, or relying on a dependency list generated by a colleague, could install the malicious version without any obvious warning sign.

`Dendreo` borrows the name of an actual French training-software company. Squatting on a real brand's name is a classic supply chain trick: search results look familiar, and trust is extended on name recognition alone.

Why Non-Developers Should Care

Supply chain attacks are indirect by design. The immediate victims are developers, but the downstream victims are everyone who uses the software those developers build.

If a developer at a bank, a hospital, or a logistics company installs a poisoned gem and the attacker gets a foothold on that developer's machine, they can steal source code, harvest authentication tokens, read secrets stored in local config files, or embed malicious logic into products that will eventually ship to customers. The Verizon 2024 Data Breach Investigations Report found that system intrusion patterns, which include supply chain compromise, accounted for a disproportionate share of records exposed in incidents affecting the information sector. One compromised developer laptop can be the thread that unravels a much larger system.

RubyGems hosts hundreds of thousands of packages and is downloaded billions of times each year. The registry, like npm and PyPI, operates on an open-publish model: anyone can upload a package. That openness accelerates development but creates a surface area that attackers actively probe.

The Control That Failed

This campaign illustrates a failure at the dependency-hygiene layer, one of the most underappreciated controls in the software development lifecycle. Organisations that have invested heavily in perimeter security, endpoint detection, and phishing training frequently leave their software supply chain on autopilot. Developers run `gem install` the same way an office worker clicks a familiar-looking email link: quickly, habitually, with trust extended to the source by default.

The absence of mandatory package verification at the CI/CD pipeline level is the direct enabling condition here. If an organisation's build process required every third-party package to be pinned to a verified checksum, pulled from a private mirror that has been scanned, and approved before it reaches a developer's local machine, SleeperGem-style attacks lose most of their effectiveness. NIST's Secure Software Development Framework (SSDF), published as NIST SP 800-218, specifically calls for organisations to verify the integrity and provenance of third-party components. Most development teams have not operationalised those controls.

The Human Behaviour Dimension

There is a behavioural component that pure tooling cannot fix. Developers are under constant pressure to move fast. Package installation is routine, low-friction, and rarely scrutinised. That cognitive environment is exactly what attackers exploit.

Security-awareness training that addresses developer-specific threats, including typosquatting, dependency confusion, and name-spoofing attacks, gives technical teams the mental model to pause before they install. Train2Secure's role-based awareness modules cover software supply chain risks alongside phishing and social engineering, because the attack surface for developers looks different from the attack surface for an accounts-payable clerk.

Organisations that treat security awareness as a once-a-year compliance checkbox miss this entirely. Developers need scenario-based training calibrated to their actual workflows.

What Defenders Should Do Right Now

If your team builds with Ruby, the immediate priority is simple. Search your local environments, Docker images, and CI/CD pipelines for `git_credential_manager` versions 2.8.0 to 2.8.3 and `Dendreo` versions 1.1.3 and 1.1.4. Remove them immediately if found.

After removal, rotate every credential that was accessible on affected machines: Git tokens, SSH keys, cloud provider API keys, and any secrets stored in local `.env` files or shell profiles. Audit Git repository activity for the period following the install date to check whether any unauthorised commits or repository clones occurred.

Beyond the immediate incident, security and engineering leadership should review:

• Whether the organisation maintains a software bill of materials (SBOM) for all internal applications.
• Whether package installs in CI/CD pipelines are gated by checksum verification.
• Whether developers have a clear, low-friction channel to report suspicious packages before installing them.
• Whether private package mirrors are in use, or whether developers pull directly from public registries.
• Whether build environments run with least-privilege accounts, limiting what a malicious package can access even if it does execute.

You can review how these controls map to recognised frameworks on the Train2Secure standards page.

What Is Still Unknown

Researchers have not yet published a full breakdown of the second-stage payload that SleeperGem packages fetch. The total number of affected developers and organisations has not been confirmed publicly. As analysis continues, additional packages or versions may be identified. Treat the current list as a floor, not a ceiling.

RubyGems typically removes confirmed malicious packages once reports are received, but the gap between upload and takedown is the window during which real infections happen. July 18, 2026 was the publish date for `git_credential_manager`. Every day that passed before the packages were flagged was a day when developers could have installed them without any warning.