SleeperGem Campaign Targets Dormant RubyGems Maintainer Accounts
Summary
Aikido reports that malicious RubyGems releases used git_credential_manager to fetch and run binaries, with a load-time trigger and CI-environment checks. The dependency also appeared in Dendreo; another affected release belonged to a separate maintainer.
Key points
- Aikido found four rapidly published versions of git_credential_manager that fetched binaries from git.disroot[.]org.
- Version 2.8.0 disabled certificate verification and ran downloaded payloads through a shell or PowerShell; VirusTotal flagged a binary as malicious.
- Version 2.8.2 wired execution into the gem’s load path, so requiring the library could trigger the dropper; version 2.8.3 uncommented the execution line.
- A skip_install? check looked for environment variables from about 30 CI platforms and stopped execution when it detected them.
- Two new Dendreo versions added git_credential_manager as a dependency, potentially exposing existing users to the payload.
- A new release of fastlane-plugin-run_tests_firebase_testlab, with 574,661 total downloads, was also flagged; it belonged to a different maintainer.
Article Details
- Attack Vectors
- The newly published git_credential_manager gem downloaded binaries from an attacker-created repository on a public Forgejo instance.
- Loading git_credential_manager with Ruby require was sufficient to trigger the installer and downloaded script.
- The dropper executed downloaded files through /bin/sh on Unix-like systems or PowerShell on Windows, with certificate verification disabled for the download.
- The attacker added git_credential_manager as a dependency of Dendreo, spreading the payload to users of that gem.
- The attacker also published a new version of fastlane-plugin-run_tests_firebase_testlab, which belonged to a different maintainer.
- A check for environment variables associated with CI platforms caused the package to do nothing when it detected a CI environment.
- Defensive Notes
- The article identifies long-dormant maintainer accounts as a profile worth monitoring for takeover and suspicious new releases.
- Review newly published gem versions and dependency changes, especially when dormant packages or maintainer accounts become active again.
- Inspect package load-time behavior and downloads from repositories for unexpected binaries or scripts.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxps[:]//git[.]disroot[.]org/git-ecosystem/ | Attacker-created repository path on a public Forgejo instance that hosted binaries identified as malicious. |
MITRE ATT&CK
T1036 · MasqueradingThe attacker used the git-ecosystem repository name and the git_credential_manager package to make the activity appear legitimate.T1059.001 · PowerShellOn Windows, the dropper launched the downloaded file through PowerShell.T1059.004 · Unix ShellOn Unix-like systems, the dropper launched the downloaded file through /bin/sh.T1078 · Valid AccountsThe article reports compromised maintainer accounts being used to publish malicious gem releases.T1105 · Ingress Tool TransferThe gem downloaded binaries from the attacker-created git-ecosystem repository.T1195.002 · Compromise Software Supply ChainThe attacker published malicious RubyGems packages and added git_credential_manager as a dependency of Dendreo to distribute the payload through trusted software.
Products
Forgejogit.disroot[.]org is a public Forgejo instance where anyone can create repositories. Someone had conveniently registered the username git-ecosystem, making the project look just legitimate enough to avoid immediateRubyGemsIt's not often we see a supply chain attack on RubyGems. But with summer vacations in full swing, perhaps we should have expected one. It was still a surprise when I opened the triage queue this morning and found a