SleeperGem backdoor skips build servers to plant persistence on developer machines

Researchers at StepSecurity documented SleeperGem, a supply chain attack in which malicious versions of three RubyGems packages were published over two days, including one impersonating Microsoft's Git Credential Manager. Each release is a loader that fetches a second stage from an attacker controlled server, then checks around thirty environment variables that continuous integration platforms set. If it finds any, it exits and does nothing; on a developer machine it drops a native daemon and installs persistence. The accounts behind the packages were ordinary ones that had gone dormant for years, which is what made them attractive to hijack, and the releases had no matching source repository tags.

Check

Check developer machines and lockfiles for the malicious gem versions published July 18 and 19, and look for unexpected daemons or persistence rather than relying on build system logs.

Affected

Developers who installed the malicious gem versions on their own machines; the loader deliberately skips continuous integration environments and instead drops a persistent native backdoor where credentials and source code live.

Fix

Remove the affected gem versions, rotate credentials on affected developer machines, treat dormant maintainer accounts and releases without matching source tags as risk signals, and monitor endpoints, not just pipelines.