SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines
A supply chain attack dubbed SleeperGem is targeting developer machines via compromised RubyGems packages.
Velocity timeline
How fast coverage is spreading — measured hourly from article rate × source diversity. How this works →
The brief
SleeperGem has deployed three malicious RubyGems packages—git_credential_manager, Dendreo, and fastlane—to drop persistent backdoors on developer machines. The attack specifically targets dormant maintainer accounts to facilitate the supply chain compromise.
Coverage from The Hacker News, Aikido Security, and StepSecurity focuses on the delivery mechanism and the specific packages affected. Additionally, cyberpress.org reports that North Korean hackers are utilizing SVG images to hide OTTERCOOKIE malware for the purpose of backdooring developers.
Future developments center on the persistence of the backdoors and the continued identification of compromised maintainer accounts.
Synthesized by Newsylist from the headlines below under a strict no-invention contract. ✓ fact-checked: all claims supported by sources Updated 6h ago.
Quick answers
Which specific RubyGems packages were compromised?
The compromised packages are git_credential_manager, Dendreo, and fastlane.
What is the primary target of the SleeperGem attack?
The attack targets developer machines by compromising dormant maintainer accounts.
What role does OTTERCOOKIE malware play?
According to cyberpress.org, North Korean hackers are hiding OTTERCOOKIE malware within SVG images to backdoor developers.
Coverage (4)
- North Korean Hackers Hide OTTERCOOKIE Malware in SVG Images to Backdoor Developers cyberpress.org · 1d ago
- SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts Aikido Security · 1d ago
- SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor StepSecurity · 1d ago
- SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines The Hacker News · 1d ago broke it first
People, places & organizations
Topics
Related trends
4 More PS Plus Extra, Premium Games Available to Download Now
Woot Has the Nintendo Switch 2 Mario Kart World Gaming Console Bundle for Just $439
Sunday Preview
Despite outrage at Sony's shift towards a discless future, only seven PlayStation games have managed more than 100,000 physical sales in the US this year
Nintendo Asks Court To Dismiss U.S. Tariff Refund Lawsuit
Nintendo is seeking to dismiss a consumer lawsuit demanding the company refund overpayments linked to U.S. tariffs.
Here are the 30,000 songs Sony is suing Udio’s AI music generator over
Sony Music has filed a new copyright lawsuit against AI music generator Udio involving over 30,000 recordings.