LOWSupply Chain
Global

SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines

·Source: The Hacker News

Updated:

Executive Summary

Cybersecurity researchers have flagged a new software supply chain attack codenamed SleeperGem targeting the Ruby ecosystem after three malicious gems were published to RubyGems with the end goal of serving additional payloads. The rogue gems are listed below - git_credential_manager (versions 2.8.0, 2.8.1, 2.8.2, 2.8.3) - Published on July 18, 2026 Dendreo (versions 1.1.3, 1.1.4) -

Analysis

Cybersecurity researchers have flagged a new software supply chain attack codenamed SleeperGem targeting the Ruby ecosystem after three malicious gems were published to RubyGems with the end goal of serving additional payloads. The rogue gems are listed below - git_credential_manager (versions 2.8.0, 2.8.1, 2.8.2, 2.8.3) - Published on July 18, 2026 Dendreo (versions 1.1.3, 1.1.4) -
Source Attribution

Originally published by The Hacker News on Jul 20, 2026.

Related Threats

MEDIUMSupply Chain

Clop Tied to PTC Product Lifecycle Management Software Hits

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/clop-tied-to-ptc-product-lifecycle-management-software-hits-image_small-8-a-32333.jpg" align=right hspace=4><b>Signs Point to Cl0p Extortion Group Again Stealing Data and Holding It to Ransom</b><br>Digital extortion group Clop, aka Cl0p, has been tied to a fresh spate of supply-chain attacks, this time targeting users of popular

Bank Info Security
MEDIUMSupply Chain

New GitHub, PyPI Policies Boost Supply Chain Security

Dependabot gets a three-day cooldown window before opening pull requests, and PyPI rejects file uploads to releases older than 14 days. The post New GitHub, PyPI Policies Boost Supply Chain Security appeared first on SecurityWeek .

SecurityWeek
MEDIUMSupply Chain

GitHub, PyPI add time-absed defenses against supply chain attacks

GitHub and PyPI (Python Package Index) have introduced a time-based mechanism in the Dependabot dependency management tool to protect against supply-chain attacks and to limit their impact. [...]

BleepingComputer