RubyGems

Cybersecurity researchers identified a new software supply chain attack named SleeperGem targeting the Ruby ecosystem through three malicious RubyGems packages. The attack involves gems like git_credential_manager (versions 2.8.0-2.8.3) and Dendreo (versions 1.1.3, 1.1.4), designed to deliver additional payloads to developer machines.

Threat actors are publishing malicious RubyGems packages that target public-facing UK government servers with scrapers, but their objective is unclear. The attackers are using RubyGems to potentially gather data or disrupt services. This incident highlights a new security risk for government agencies.

GemStuffer has targeted the RubyGems repository with over 150 gems to exfiltrate data from a U.K. council portal. The gems are used as a data exfiltration channel rather than for malware distribution. Many of the packages have little or no download activity and repetitive payloads.

RubyGems has paused new signups due to a major malicious attack where hundreds of malicious packages were uploaded. The attack is being dealt with by the RubyGems team. Signups are currently paused as a precautionary measure.