SleeperGem Supply Chain Attack Targets Ruby Development Ecosystem

Cybersecurity researchers have identified a new software supply chain attack named SleeperGem, targeting the Ruby development ecosystem. Three malicious gems were published to RubyGems, a widely used package repository for Ruby developers, with the intention of delivering additional payloads to compromised developer machines. The rogue packages include git_credential_manager (versions 2.8.0 through 2.8.3, published on 18 July 2026), Dendreo (versions 1.1.3 and 1.1.4) and another unnamed package. The attack follows a familiar pattern where attackers publish packages with names similar to legitimate tools or libraries, relying on developers installing them either by mistake or without sufficient scrutiny of the source. This type of attack, often referred to as typosquatting or dependency confusion, has become increasingly common across multiple package ecosystems including npm, PyPI and now RubyGems.

Why this matters for UK organisations

For UK organisations with software development teams, this incident highlights the operational risk that sits within dependency management and build pipelines. Ruby is used across a range of enterprise applications, internal tooling, web platforms and content management systems, meaning a compromised gem could affect production systems, CI/CD environments or developer workstations. The risk is not limited to large-scale breaches; even a single compromised developer machine can provide attackers with access to source code, credentials, cloud environments or internal networks. Supply chain attacks targeting package repositories have become a consistent threat because they exploit the trust relationship between developers and the open-source ecosystems they rely on. Once a malicious package is installed, it can execute arbitrary code, exfiltrate sensitive data, establish persistence or serve as a foothold for further compromise. The challenge for organisations is that these attacks often bypass traditional perimeter defences because the malicious code is introduced through legitimate development workflows.

What to review

UK businesses with development teams should review how dependencies are managed, verified and monitored across Ruby projects and other development environments. Consider whether your teams have visibility into what packages are being installed, whether there are controls around package sources, and whether build pipelines include checks for known malicious or suspicious dependencies. Review whether there is a process for vetting new dependencies before they are added to projects, whether dependency lock files are used to ensure consistent and reviewed package versions, and whether there are tools in place to scan for known vulnerabilities or anomalies in installed packages. Consider whether developer workstations and build environments are segmented from production systems and whether there are monitoring controls in place to detect unusual activity such as unexpected network connections or credential access. Ensure there is clear ownership for managing software supply chain risk across development, security and DevOps teams, and that there is a process for responding quickly when malicious packages are identified in public repositories.

Source: The Hacker News