SleeperGem abuses RubyGems by shipping malicious gems for extra payloads

Intelligence Summary

A supply chain campaign called SleeperGem has been tied to malicious RubyGems packages. Three rogue gems were published with version ranges that could be pulled during normal Ruby dependency installs. Once fetched, the packages are intended to deliver additional payloads to developer machines. This can lead to unauthorized code execution and compromise of workstations and build environments. Ruby maintainers and developers should verify gem sources, pin dependencies, and review lockfiles for these names and versions.

Recommended Action

Review affected assets, schedule urgent remediation, and monitor related indicators.

Topics