SleeperGem Malicious RubyGems Target Dev Machines in Supply Chain Attack

Overview of SleeperGem

Cybersecurity researchers have reported a software supply chain attack dubbed SleeperGem, which affects the Ruby ecosystem. Three malicious RubyGems were found to be published to RubyGems, designed to deliver additional malicious payloads to target developer machines.

Malicious Packages Identified

The rogue gems include 'git_credential_manager' (versions 2.8.0 to 2.8.3), 'Dendreo' (versions 1.1.3, 1.1.4), and 'fastlane-plugin-run_tests_firebase_testlab' (version 0.3.2). Each of these packages acts as a loader, which retrieves a second stage from an attacker-controlled Forgejo host.

Impersonation and Dormancy

'git_credential_manager' pretends to be the legitimate Microsoft Git Credential Manager. Remarkably, 'Dendreo' and 'fastlane-plugin-run_tests_firebase_testlab' had not received updates for years prior to the malicious modifications, showing a pattern of sudden compromise of previously dormant gems.

Spread of the Malicious Payload

The malicious 'git_credential_manager' has been included as a dependency in five other packages, facilitating the spread of its malicious code. This raises concerns about the security of those packages, as multiple accounts may have been compromised to publish these rogue versions directly.

Targeting Developer Machines

Upon installation, the malware scans for about 30 environment variables related to popular CI/CD tools. It is programmed to exit if these are found, indicating a strategy to ensure execution on developer machines rather than ephemeral CI environments.