SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines

Security researchers uncovered "SleeperGem", a malicious software supply-chain campaign where attackers published rogue RubyGems that load additional payloads from an attacker-controlled Forgejo host, avoid CI environments, drop native daemons, establish persistence (cron and systemd user service), and attempt privilege escalation by planting a setuid root shell; the report also highlights separate abuse of RubyGems as a dead-drop for exfiltrated credentials and other sensitive data.