--- title: SleeperGem: Compromised git_credential_manager, Dendreo,... description: Between July 18–19, 2026, three RubyGems packages — git_credential_manager, Dendreo, and fastlane-plugin-run_tests_firebase_testlab — were compromised in a... canonical: https://daily.dev/posts/sleepergem-compromised-git-credential-manager-dendreo-and-fastlane-rubygems-drop-a-persistent-bac-65jetenzq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor | daily.dev og:description: Between July 18–19, 2026, three RubyGems packages — git_credential_manager, Dendreo, and fastlane-plugin-run_tests_firebase_testlab — were compromised in a... og:url: https://daily.dev/posts/sleepergem-compromised-git-credential-manager-dendreo-and-fastlane-rubygems-drop-a-persistent-bac-65jetenzq og:image: https://api.daily.dev/og/posts/65JetENZq.png og:image:alt: SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor **[StepSecurity](https://daily.dev/sources/stepsecurity)** · 9 min read · 1 upvotes · 0 comments ## Summary Between July 18–19, 2026, three RubyGems packages — git_credential_manager, Dendreo, and fastlane-plugin-run_tests_firebase_testlab — were compromised in a coordinated supply chain attack dubbed SleeperGem. Each malicious gem acts as a loader: it checks for ~30 CI environment variables and silently exits if found, specifically targeting developer laptops. On a developer machine, it fetches a second-stage payload (deploy.sh and a native binary) from an attacker-controlled Forgejo host, drops a persistent daemon in ~/.local/share/gcm/, installs dual persistence via systemd and cron, and attempts privilege escalation by planting a setuid root shell at /usr/local/sbin/ping6. StepSecurity analyzed the full kill chain using Harden-Runner. Affected developers should uninstall the malicious gems, remove persistence artifacts, check for the backdoor shell, and rotate all credentials. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Which RubyGems versions were compromised in the SleeperGem supply chain attack? The compromised versions are git_credential_manager 2.8.0 through 2.8.3, Dendreo 1.1.3 and 1.1.4, and fastlane-plugin-run_tests_firebase_testlab 0.3.2. These were published directly to RubyGems.org between July 18 and 19, 2026 with no matching commit or tag in the source repositories, and two of the gems had been dormant for years before suddenly shipping new versions. _Track newly disclosed package compromises like this one on daily.dev before they hit a build._ ### How does the SleeperGem malware in git_credential_manager avoid detection in CI pipelines? It checks for around thirty environment variables set by continuous integration platforms, including GITHUB_ACTIONS, GITLAB_CI, and CIRCLECI, and exits immediately if any are found. This means the malware only activates on developer laptops, where there is more of value and less chance of detection, while a normal CI pipeline install shows no malicious behavior at all. _Understanding evasion techniques like this helps developers vet dependencies more carefully via daily.dev._ ### What persistence mechanisms does the SleeperGem backdoor install on a developer machine? The dropped daemon installs persistence twice: once as a systemd user service and once as a cron entry, both under the innocuous name git-credential-manager, so it restarts even if one method is removed. It also probes sudo and wheel group membership, and if passwordless sudo is available, it plants a setuid root copy of the system shell at /usr/local/sbin/ping6. _Developers hardening their machines against this kind of persistence can follow ongoing coverage on daily.dev._ ## Similar posts on daily.dev - [The Hidden Dangers in Your Gemfile: Supply Chain Attacks in RubyGems - FastRuby.io](https://daily.dev/posts/the-hidden-dangers-in-your-gemfile-supply-chain-attacks-in-rubygems---fastruby-io-rtyemnyzl) · RUBYLAND · 0 upvotes · 0 comments - [Malicious Ruby Gems and Go Modules Impersonate Developer Too...](https://daily.dev/posts/malicious-ruby-gems-and-go-modules-impersonate-developer-too--iyu63tfzm) · Socket · 1 upvotes · 0 comments - [199 RubyGems, two techniques, zero working payloads: Inside a cryptomining campaign that never ran](https://daily.dev/posts/199-rubygems-two-techniques-zero-working-payloads-inside-a-cryptomining-campaign-that-never-ran-klqjdu1va) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#cicd](https://daily.dev/tags/cicd), [#malware](https://daily.dev/tags/malware), [#ruby](https://daily.dev/tags/ruby) [View this post on daily.dev](https://daily.dev/posts/sleepergem-compromised-git-credential-manager-dendreo-and-fastlane-rubygems-drop-a-persistent-bac-65jetenzq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor","url":"https://daily.dev/posts/sleepergem-compromised-git-credential-manager-dendreo-and-fastlane-rubygems-drop-a-persistent-bac-65jetenzq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/sleepergem-compromised-git-credential-manager-dendreo-and-fastlane-rubygems-drop-a-persistent-bac-65jetenzq"},"datePublished":"2026-07-19T15:40:35.705Z","dateModified":"2026-09-14T08:32:47.359Z","description":"Between July 18–19, 2026, three RubyGems packages — git_credential_manager, Dendreo, and fastlane-plugin-run_tests_firebase_testlab — were compromised in a...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4350628800f9d7c4932235d92f8c690f?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4350628800f9d7c4932235d92f8c690f?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"StepSecurity","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"StepSecurity","logo":"https://media.daily.dev/image/upload/s--vegWii-S--/f_auto,q_auto/v1774959924/logos/stepsecurity?_a=BAMAMiWQ0","url":"https://daily.dev/sources/stepsecurity"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/sleepergem-compromised-git-credential-manager-dendreo-and-fastlane-rubygems-drop-a-persistent-bac-65jetenzq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,cicd,malware,ruby","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"StepSecurity","item":"https://daily.dev/sources/stepsecurity"},{"@type":"ListItem","position":3,"name":"SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/sleepergem-compromised-git-credential-manager-dendreo-and-fastlane-rubygems-drop-a-persistent-bac-65jetenzq#faq","mainEntity":[{"@type":"Question","name":"Which RubyGems versions were compromised in the SleeperGem supply chain attack?","acceptedAnswer":{"@type":"Answer","text":"The compromised versions are git_credential_manager 2.8.0 through 2.8.3, Dendreo 1.1.3 and 1.1.4, and fastlane-plugin-run_tests_firebase_testlab 0.3.2. These were published directly to RubyGems.org between July 18 and 19, 2026 with no matching commit or tag in the source repositories, and two of the gems had been dormant for years before suddenly shipping new versions. Track newly disclosed package compromises like this one on daily.dev before they hit a build."}},{"@type":"Question","name":"How does the SleeperGem malware in git_credential_manager avoid detection in CI pipelines?","acceptedAnswer":{"@type":"Answer","text":"It checks for around thirty environment variables set by continuous integration platforms, including GITHUB_ACTIONS, GITLAB_CI, and CIRCLECI, and exits immediately if any are found. This means the malware only activates on developer laptops, where there is more of value and less chance of detection, while a normal CI pipeline install shows no malicious behavior at all. Understanding evasion techniques like this helps developers vet dependencies more carefully via daily.dev."}},{"@type":"Question","name":"What persistence mechanisms does the SleeperGem backdoor install on a developer machine?","acceptedAnswer":{"@type":"Answer","text":"The dropped daemon installs persistence twice: once as a systemd user service and once as a cron entry, both under the innocuous name git-credential-manager, so it restarts even if one method is removed. It also probes sudo and wheel group membership, and if passwordless sudo is available, it plants a setuid root copy of the system shell at /usr/local/sbin/ping6. Developers hardening their machines against this kind of persistence can follow ongoing coverage on daily.dev."}}]} ```