SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor

SleeperGem is a supply chain attack targeting the RubyGems ecosystem. Three popular gems—git_credential_manager, Dendreo, and fastlane—were compromised to distribute malicious code that establishes persistent backdoor access on developer systems.\n\nThe attack works by embedding code in the compromised gems that fetches a second-stage payload from a Forgejo-based command-and-control server. The malicious code is designed to evade detection by skipping CI/CD pipeline checks, allowing it to execute directly on developer machines during local development or build processes.\n\nOnce executed, the payload installs a persistent daemon, giving attackers ongoing access to compromised systems. This approach targets the developer environment rather than relying solely on package installation, increasing the likelihood of successful compromise.\n\nStepSecurity's analysis, conducted with Harden-Runner, identified and documented the attack chain and indicators of compromise.