SleeperGem: Three Malicious RubyGems Are Stealing Developer Credentials Right Now

What Happened

Security researchers have uncovered an active Ruby supply chain attack dubbed SleeperGem, in which three malicious packages were published to the RubyGems registry with the explicit goal of stealing credentials from developer machines and downloading additional payloads. One of the confirmed rogue gems is git_credential_man — a name crafted to blend in with legitimate developer tooling. The attack is documented in a new report from The Hacker News.

The "sleeper" framing isn't marketing — it describes the attack's behavior: the gems appear benign on install, then phone home or execute secondary stages after a delay, making detection harder during routine code review.

Why It Matters

Supply chain attacks against package registries are among the most dangerous threat vectors for developers because they exploit the trust implicit in gem install. Unlike a phishing email, a malicious gem runs with the same privileges as your shell the moment it executes, with no warning prompt.

The credential theft angle makes this especially damaging. Developer machines are credential goldmines — SSH keys, AWS/GCP tokens, GitHub personal access tokens, .netrc files, Kubernetes configs, and, critically, Git credential helpers (hence the name git_credential_man). A single compromised developer workstation can become a pivot point into source repositories, CI/CD pipelines, and production cloud environments.

RubyGems does not perform static behavioral analysis of uploaded packages, so the gems were live in the registry before detection. Any project that pulled one of these gems — directly or as a transitive dependency — should be treated as potentially compromised.

What To Do

If you use Ruby, act now:

1. Audit installed gems. Run gem list and check your Gemfile.lock for git_credential_man and any unfamiliar gems you haven't explicitly added. Cross-reference with your team's expected dependency tree.

1. Check transitive dependencies. A malicious gem can arrive via a dependency of a dependency. Use bundle exec gem dependency <suspect-gem> to trace the chain.

1. Assume credential compromise if affected. If any project environment installed these gems:

- Rotate Git tokens (GitHub, GitLab, Bitbucket) - Rotate cloud provider credentials (AWS, GCP, Azure) - Revoke and reissue SSH keys if stored in locations accessible during build - Check for unauthorized commits, repository access, or CI/CD pipeline modifications

1. Review CI/CD logs. Supply chain attacks often target build runners where credentials are injected as environment variables. Check for anomalous outbound network calls during recent builds.

1. Pin and verify gems. Going forward, use bundle exec with a locked Gemfile.lock, enable Bundler's --frozen flag in CI, and consider adding gem checksum verification.

The full list of malicious gem names beyond git_credential_man should be confirmed via the original advisory as researchers continue updating their findings. Do not wait for an internal security ticket — check your environments today.