SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor

Between July 18 and July 19, 2026, a coordinated supply chain attack dubbed SleeperGem compromised three RubyGems packages: git_credential_manager, Dendreo, and fastlane-plugin-run_tests_firebase_testlab. These malicious packages act as loaders, downloading a second-stage payload from an attacker-controlled Forgejo instance and installing a persistent backdoor on developer machines. The malware evades detection in CI environments by checking for CI-specific environment variables and only activates on developer laptops, where it establishes persistence via systemd and cron, and may escalate privileges by planting a setuid root shell.

AI-extracted · verify before operational use