SleeperGem attack compromises RubyGems, targets developer machines

The article discusses a coordinated supply chain attack named "SleeperGem", where malicious versions of three RubyGems packages—`git_credential_manager`, `Dendreo`, and `fastlane-plugin-run_tests_firebase_testlab`—were published to RubyGems.org. These compromised gems act as loaders, fetching further malware from a controlled Forgejo host. The attack specifically targets developer machines, ignoring CI systems, and installs a persistent daemon.

Key points include the detection of malicious activity by comparing publish timelines with GitHub tags, the behavior of the malicious gems, and instructions for recovery and protection. The attackers implemented methods to avoid detection, such as checking environment variables for CI systems and staging attacks across different gem versions. The article emphasizes the importance of monitoring and detecting such threats using tools like StepSecurity's Harden-Runner and Dev Machine Guard.