SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines
A supply chain attack named SleeperGem is leveraging compromised RubyGems packages to drop persistent backdoors onto developer machines.
Velocity
How fast coverage is spreading — measured hourly from article rate × source diversity. How this works →
The brief
The SleeperGem attack targets dormant maintainer accounts to distribute malicious code. Three specific RubyGems packages—git_credential_manager, Dendreo, and fastlane—have been compromised to deploy a persistent backdoor.
Coverage from The Hacker News, Aikido Security, and StepSecurity emphasizes the supply chain nature of the attack. Additionally, cyberpress.org reports that North Korean hackers are utilizing SVG images to hide OTTERCOOKIE malware for the purpose of backdooring developers.
Future developments depend on the mitigation of the compromised packages and the identification of further malware delivery methods used by the attackers.
Synthesized by Archynetys from the headlines below under a strict no-invention contract. ✓ fact-checked: all claims supported by sources Updated 6h ago.
Quick answers
Which RubyGems packages are affected by SleeperGem?
The compromised packages are git_credential_manager, Dendreo, and fastlane.
What is the primary target of the SleeperGem attack?
The attack targets developer machines by compromising dormant maintainer accounts.
What other malware is associated with these developer targets?
According to cyberpress.org, North Korean hackers are using SVG images to hide OTTERCOOKIE malware.
Coverage (4)
- North Korean Hackers Hide OTTERCOOKIE Malware in SVG Images to Backdoor Developers cyberpress.org · 1d ago
- SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts Aikido Security · 1d ago
- SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor StepSecurity · 1d ago
- SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines The Hacker News · 1d ago
Topics
Related trends
Pokémon GO Fest 2026: Raid Make-Up Event
4 More PS Plus Extra, Premium Games Available to Download Now
Woot Has the Nintendo Switch 2 Mario Kart World Gaming Console Bundle for Just $439
"Professional lurker" Todd Howard reappears on internet forums following Bethesda's Fallout and Elder Scrolls announcements to thank fans for their support
Despite outrage at Sony's shift towards a discless future, only seven PlayStation games have managed more than 100,000 physical sales in the US this year
Nintendo Asks Court To Dismiss U.S. Tariff Refund Lawsuit
Nintendo is seeking to dismiss a consumer lawsuit claiming the company should reimburse gamers for console overpayments linked to U.S. tariffs.