SECURITYJul 20 · 05:15 UTCTHE HACKER NEWS[email protected] (The Hacker News)

SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines

Cybersecurity researchers identified a new software supply chain attack named SleeperGem targeting the Ruby ecosystem through three malicious RubyGems packages. The attack involves gems like git_credential_manager (versions 2.8.0-2.8.3) and Dendreo (versions 1.1.3, 1.1.4), designed to deliver additional payloads to developer machines.

Nexus surfaces and summarizes. The full story lives at the source.

Mentioned

SleeperGemtopicRubyGemsorganizationgit_credential_managertopicDendreotopic

Spot something wrong with this article?Report a problem →

Forward this

Related Signal

Adjacent reporting

SECURITYMay 1 · 09:43 UTC
Poisoned Ruby Gems and Go Modules Exploit CI Pipelines for Credential Theft
SECURITYApr 30 · 23:21 UTC
The never-ending supply chain attacks worm into SAP npm packages, other dev tools
SECURITYApr 22 · 22:34 UTC
Another npm supply chain worm is tearing through dev environments
SECURITYMay 12 · 11:29 UTC
Shai Hulud attack ships signed malicious TanStack, Mistral npm packages
SECURITYJun 5 · 18:05 UTC
IronWorm and New Miasma Worm Variant Hit npm in Supply Chain Attacks
SECURITYApr 29 · 16:26 UTC
SAP npm Packages Compromised by “Mini Shai-Hulud” Credential-Stealing Malware