We’re launching Lyria 3.5 in Google Flow Music, with advances across musicality, lyrics, vocals, and creative control
deepmind.google·6d ago
AI Engineering
Lobsters·15d ago·5 min read
SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts
TL;DR
A supply chain attack targeting dormant RubyGems maintainer accounts was discovered, involving a malicious gem named git_credential_manager. This gem rapidly published multiple versions that downloaded binaries from an unknown host.
✦ Why It Matters
Review and secure your RubyGems maintainer accounts to prevent unauthorized access and potential supply chain attacks.
Key Takeaways
- Audit your RubyGems accounts for inactivity.
- Implement security measures for dormant accounts.
- Monitor dependencies for suspicious activity.
- Educate teams on supply chain security risks.
How It Works
The malicious gem was designed to download binaries from a compromised Git repository, executing them on user machines. It included mechanisms to disable SSL verification and check for CI environment variables to avoid detection.