# SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines

> **Newsylist Open Intelligence Dossier** · First detected: 2026-07-21 03:29 UTC · Category: Technology · Sources: 4 · Current Velocity: 2

## Executive Summary
A supply chain attack dubbed SleeperGem is utilizing compromised RubyGems packages to drop persistent backdoors on developer machines.

## Intelligence Brief
SleeperGem has targeted developer machines by compromising three RubyGems packages: git_credential_manager, Dendreo, and fastlane. The attack involves the use of malicious packages to establish persistent backdoors.


Coverage from The Hacker News, StepSecurity, and Aikido Security emphasizes that the attack specifically targets dormant maintainer accounts. Additionally, cyberpress.org reports that North Korean hackers are hiding OTTERCOOKIE malware within SVG images to backdoor developers.


Future monitoring will focus on the impact of the compromised RubyGems packages and the distribution of the OTTERCOOKIE malware.

## Verified Facts & Key Claims
### Which specific packages were affected by SleeperGem?
The compromised RubyGems packages are git_credential_manager, Dendreo, and fastlane.

### How did the SleeperGem attack gain access?
According to Aikido Security, the supply chain attack targeted dormant maintainer accounts.

### What role do SVG images play in these reports?
Cyberpress.org reports that North Korean hackers are using SVG images to hide OTTERCOOKIE malware.

## Key People, Organizations & Locations
SleeperGem Uses Three Malicious RubyGems Packages, Target Developer Machines, North Korean Hackers Hide OTTERCOOKIE Malware, SVG Images, Backdoor Developers, SleeperGem RubyGems, SleeperGem Compromised, Dendreo

## Multi-Source Evidence Table
| Source Outlet | Headline | Published (UTC) | Verification URL |
|---|---|---|---|
| cyberpress.org | North Korean Hackers Hide OTTERCOOKIE Malware in SVG Images to Backdoor Developers | 2026-07-20 05:15 | [Source Link](https://news.google.com/rss/articles/CBMic0FVX3lxTE81bElCLWhSdU1YNURSQWFMY2g3RmxnMEtrRF9qbTBwcG1Bb1ZkYjhLS0lSRklZZU9tcVgyTTE0N1h5ZHZIaDNSS3RSN0U3eG42V1BzZk01Tk40OEoxTHRpaU1aUDA2RzlaYnlRdXd5NnNhOHPSAXNBVV95cUxPNWxJQi1oUnVNWDVEUkFhTGNoN0ZsZzBLa0Rfam0wcHBtQW9WZGI4S0tJUkZJWWVPbXFYMk0xNDdYeWR2SGgzUkt0UjdFN3huNldQc2ZNNU5ONDhKMUx0aWlNWlAwNkc5WmJ5UXV3eTZzYThz?oc=5) |
| Aikido Security | SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts | 2026-07-20 05:15 | [Source Link](https://news.google.com/rss/articles/CBMidkFVX3lxTE04SjYxZHRuZm12cmpsVGphMDRnOEZnazdmWE1GbVhDV1BfNlA3ZmhTXzBuNnhPemp3Q2lHZDFUS0JmSXJMam96QWhVdEVQR0FZSC1BNzZzRmNUOWU1RVBEN3F3bGFNR2JMRXRScC1aRDgxb0lJeVE?oc=5) |
| StepSecurity | SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor | 2026-07-20 05:15 | [Source Link](https://news.google.com/rss/articles/CBMikwFBVV95cUxNaExfRTM2X1RyOGE1NEpQZjluT0dHeTByaFgyR3Q3MUNnYVdZR19pYktmZklLdE4wYUEtbS1ONmFHRklZSGYyc1dmMlFVVlRLZ3dGMmd3eGJJQ1I1eTNJWWdKdHRMa3ZaUV8zR3MyS0k4bFcwWExEb080UjdQYXdEcUk2TTBBQ2xtQVpKcUxzaE9haVU?oc=5) |
| The Hacker News | SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines | 2026-07-20 05:15 | [Source Link](https://news.google.com/rss/articles/CBMiekFVX3lxTE1LUE1Vb1BzZ2I5eTh4ejJzNHFhQmRhUmdjMWpWN1RHRzBPazVxOF9GZ0xkTjhabzZQLWt3Nmk3clE4bW1nMFV2Q3VYNnpDcGJvaWxIbTdLdmswZlZhLTE2RUFwVk1IbTdtUm82V0FLTDVmVDRXOGhCbGlB?oc=5) |

---
*Canonical Source: https://www.newsylist.com/trend/2026-07-21/sleepergem-uses-three-malicious-rubygems-packages-to-target-developer-machines*
*Synthesized by Newsylist Open Intelligence Engine under E-E-A-T journalistic standards.*