In a recent cybersecurity alert, researchers have identified a new supply chain attack within the Ruby ecosystem, dubbed SleeperGem. This threat involves three malicious packages uploaded to RubyGems, aiming to deliver additional harmful payloads to developers’ systems.
Details of the SleeperGem Attack
StepSecurity conducted an analysis, revealing that these malicious packages act as loaders. They retrieve a second-stage payload from a Forgejo server controlled by attackers. This payload is designed to bypass build systems but targets developer machines, where it deploys a native daemon and ensures persistence.
A distinctive feature of this attack is the impersonation of the official Microsoft Git Credential Manager by a package named git_credential_manager. Other affected packages include Dendreo and fastlane-plugin-run_tests_firebase_testlab, which had been inactive for years before receiving harmful updates. Notably, these packages were uploaded to the registry without corresponding source project commits or tags.
How the Attack Propagates
The malicious git_credential_manager has been added as a dependency to several packages, including Dendreo and fastlane-plugin-run_tests_firebase_testlab. This method facilitates the spread of malicious code to existing users. Most of these packages, excluding fastlane-plugin-run_tests_firebase_testlab, are maintained by a single account known as ‘LR-DEV’. However, the presence of multiple compromised accounts suggests a broader infiltration strategy.
Once installed, the malware scans systems for environment variables related to continuous integration (CI) services such as GitHub Actions and Jenkins. If detected, the malware terminates to avoid execution on ephemeral CI environments, ensuring it only runs on developer machines.
Implications and Recommendations
The attack’s severity is illustrated by the behavior of git_credential_manager, which downloads and executes payloads via PowerShell on Windows. While version 2.8.2 simply stages these payloads, version 2.8.3 escalates the attack by launching a background daemon and establishing persistence through cron jobs and systemd services.
Security experts urge users of the affected packages to consider their systems and credentials compromised. They recommend removing the embedded daemon, eradicating persistence mechanisms, and rotating all sensitive credentials. Additionally, users should inspect for any unauthorized setuid shells being used within their systems.
The SleeperGem incident highlights the vulnerabilities of seemingly inactive accounts within software repositories. As Aikido Security’s Charlie Eriksen noted, the dormant state of these accounts made them prime targets for hijacking.
In a broader context, RubyGems has previously faced similar threats, including a recent spam campaign that temporarily halted account sign-ups. These events underscore the need for heightened vigilance and security practices to protect the integrity of software supply chains.
