--- title: SleeperGem: How attackers hijacked dormant RubyGems... description: Between July 18–19, 2026, three RubyGems packages were compromised in a coordinated supply chain attack dubbed SleeperGem. Attackers hijacked dormant... canonical: https://daily.dev/posts/sleepergem-how-attackers-hijacked-dormant-rubygems-accounts-to-push-a-persistent-backdoor-x253e5cla twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: SleeperGem: How attackers hijacked dormant RubyGems accounts to push a persistent backdoor | daily.dev og:description: Between July 18–19, 2026, three RubyGems packages were compromised in a coordinated supply chain attack dubbed SleeperGem. Attackers hijacked dormant... og:url: https://daily.dev/posts/sleepergem-how-attackers-hijacked-dormant-rubygems-accounts-to-push-a-persistent-backdoor-x253e5cla og:image: https://api.daily.dev/og/posts/X253e5CLa.png og:image:alt: SleeperGem: How attackers hijacked dormant RubyGems accounts to push a persistent backdoor og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # SleeperGem: How attackers hijacked dormant RubyGems accounts to push a persistent backdoor **[Collections](https://daily.dev/sources/collections)** · 2 min read · 5 upvotes · 0 comments ## Summary Between July 18–19, 2026, three RubyGems packages were compromised in a coordinated supply chain attack dubbed SleeperGem. Attackers hijacked dormant maintainer accounts to publish malicious versions of `git_credential_manager`, `Dendreo`, and `fastlane-plugin-run_tests_firebase_testlab` (574K+ downloads). The malicious gems function as loaders that skip execution in CI environments (checking ~30 CI env vars) and instead target developer laptops, fetching a second-stage payload from an attacker-controlled Forgejo host. The payload installs a persistent daemon, sets up dual persistence via systemd and cron, and attempts privilege escalation via a setuid root shell. Affected users should uninstall the gems, remove persistence artifacts, check for the backdoor shell at `/usr/local/sbin/ping6`, and rotate all credentials. The attack highlights dormant maintainer accounts as a structural weakness across package ecosystems. ## Content ## What happened Between July 18–19, 2026, three RubyGems packages were compromised in a coordinated supply chain attack researchers are calling SleeperGem. The affected gems are `git_credential_manager`, `Dendreo`, and `fastlane-plugin-run_tests_firebase_testlab` — the last of which has over 574,000 downloads. The attacker gained access by hijacking at least two dormant maintainer accounts — accounts that had been inactive long enough to fly under the radar. This is the "SleeperGem" pattern: low-activity accounts that nobody's watching, which makes them attractive targets. The technique has shown up before on npm and PyPI, but this appears to be RubyGems' first coordinated attack of this kind. ## The kill chain The attacker published `git_credential_manager` in four rapid versions, each iteration more sophisticated than the last — starting as a basic binary dropper and ending as a payload that executes on a bare `require`. They also injected it as a dependency into the other two trusted gems, spreading the blast radius without needing to compromise additional accounts directly. Each malicious gem functions as a loader with a specific evasion check: it scans for roughly 30 CI environment variables and silently exits if any are found. The goal is developer laptops, not build servers. On a non-CI machine, the gem reaches out to an attacker-controlled Forgejo host and fetches a second-stage payload — `deploy.sh` and a native binary. From there: - A persistent daemon is dropped into `~/.local/share/gcm/` - Dual persistence is installed via systemd and cron - The attack attempts privilege escalation by planting a setuid root shell at `/usr/local/sbin/ping6` StepSecurity analyzed the full kill chain using Harden-Runner. ## What to do if you're affected If you've installed any of the three gems recently, the recommended steps are: 1. Uninstall the malicious gems 2. Remove persistence artifacts from `~/.local/share/gcm/`, systemd units, and cron entries 3. Check for the backdoor shell at `/usr/local/sbin/ping6` 4. Rotate all credentials that were accessible on the affected machine ## The broader pattern What makes this attack worth paying attention to isn't just the technical sophistication — it's the entry point. Dormant maintainer accounts are a structural weakness in package ecosystems. They're trusted by virtue of past contributions, rarely monitored, and often secured with older credentials. The attacker didn't need to find a zero-day; they just needed to find an account nobody was watching. RubyGems maintainers with inactive accounts should review their credentials and enable MFA if they haven't already. ## Similar posts on daily.dev - [GemStuffer Campaign Abuses RubyGems as Exfiltration Channel ...](https://daily.dev/posts/gemstuffer-campaign-abuses-rubygems-as-exfiltration-channel--a8nbznkit) · Socket · 1 upvotes · 0 comments - [The Hidden Dangers in Your Gemfile: Supply Chain Attacks in RubyGems - FastRuby.io](https://daily.dev/posts/the-hidden-dangers-in-your-gemfile-supply-chain-attacks-in-rubygems---fastruby-io-rtyemnyzl) · RUBYLAND · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#malware](https://daily.dev/tags/malware), [#ruby](https://daily.dev/tags/ruby) [View this post on daily.dev](https://daily.dev/posts/sleepergem-how-attackers-hijacked-dormant-rubygems-accounts-to-push-a-persistent-backdoor-x253e5cla) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"SleeperGem: How attackers hijacked dormant RubyGems accounts to push a persistent backdoor","url":"https://daily.dev/posts/sleepergem-how-attackers-hijacked-dormant-rubygems-accounts-to-push-a-persistent-backdoor-x253e5cla","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/sleepergem-how-attackers-hijacked-dormant-rubygems-accounts-to-push-a-persistent-backdoor-x253e5cla"},"datePublished":"2026-07-19T15:41:21.734Z","dateModified":"2026-07-19T15:42:01.767Z","description":"Between July 18–19, 2026, three RubyGems packages were compromised in a coordinated supply chain attack dubbed SleeperGem. Attackers hijacked dormant...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4350628800f9d7c4932235d92f8c690f?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4350628800f9d7c4932235d92f8c690f?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/sleepergem-how-attackers-hijacked-dormant-rubygems-accounts-to-push-a-persistent-backdoor-x253e5cla","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":5},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,malware,ruby","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"SleeperGem: How attackers hijacked dormant RubyGems accounts to push a persistent backdoor"}]} ```