2 months ago
- A supply chain attack on RubyGems was discovered via a new gem called git_credential_manager that downloaded malicious binaries from a Forgejo instance.
- The gem evolved over four versions in nine hours, starting as a dropper, then silencing output, and finally executing on library load rather than explicit command.
- The malware avoids CI environments by checking for over 30 environment variables, targeting developer laptops.
- The attacker also compromised other gems (Dendreo and fastlane-plugin-run_tests_firebase_testlab) by adding the malicious gem as a dependency or hijacking accounts.
- Two long-dormant maintainer accounts were reactivated to push the malicious code, highlighting the risk of inactive accounts in package registries.
- This marks RubyGems' first major incident of this type, similar to attacks previously seen on npm and PyPI.