SleeperGem: RubyGems Supply Chain Attack via Compromised Dormant Maintainer Accounts

Key facts for SleeperGem 574K-download gems

Detection coverage for SleeperGem 574K-download gems

As of 2026-07-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1514 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Ruby Toolchain Spawning PowerShell/Shell with Bypass Flags (SleeperGem Dropper Execution)

Detects a ruby/gem/bundle/rake process spawning powershell.exe with -ExecutionPolicy Bypass, or /bin/sh executing a script from a temp directory, matching the exact SleeperGem dropper execution strings (`powershell -ExecutionPolicy bypass "#{full_path}"` / `/bin/sh "#{full_path}"`) that fire when a require-triggered load-path hook (git_credential_manager 2.8.2/2.8.3) runs its payload.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1554, T1059.001, T1059.004, T1036.005
• Data sources: sysmon, windows_security, device_process_events, edr_process_telemetry
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval parent=lower(ParentImage)
| eval child=lower(Image)
| where match(parent, "(ruby|gem|bundle|rake)(\.exe)?$")
| where match(child, "powershell\.exe$") OR match(child, "sh$")
| where match(CommandLine, "(?i)-executionpolicy\s+bypass") OR match(CommandLine, "(?i)/tmp/|/temp/|%temp%")
| stats count min(_time) as first_seen max(_time) as last_seen by host, User, ParentImage, Image, CommandLine
| table first_seen, last_seen, host, User, ParentImage, Image, CommandLine, count

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName has_any ("ruby", "gem", "bundle", "rake")
| where (FileName =~ "powershell.exe" and ProcessCommandLine has "-ExecutionPolicy" and ProcessCommandLine has "Bypass")
    or (FileName in ("sh", "/bin/sh") and ProcessCommandLine has_any ("/tmp/", "temp"))
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| order by Timestamp desc

Sigma

title: Ruby Toolchain Spawning PowerShell or Shell with Execution-Policy Bypass
id: 6b9d4e33-1514-4b02-8f22-sleepergem002
status: experimental
description: Detects a Ruby/gem/bundle/rake process spawning powershell.exe with -ExecutionPolicy Bypass or /bin/sh against a temp-directory script, matching the SleeperGem dropper's exact post-require execution pattern.
references:
    - https://www.aikido.dev/blog/sleepergem-rubygems-supply-chain-attack
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-19
tags:
    - attack.persistence
    - attack.t1554
    - attack.execution
    - attack.t1059.001
    - attack.t1059.004
    - attack.defense-evasion
    - attack.t1036.005
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\ruby.exe'
            - '\rake.exe'
            - '\bundle.exe'
            - '\gem.exe'
    selection_child:
        Image|endswith: '\powershell.exe'
        CommandLine|contains|all:
            - '-ExecutionPolicy'
            - 'Bypass'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate Ruby-invoked deployment or build scripts that intentionally shell out to PowerShell (rare; verify script path, publisher, and signing)
level: high

Known false positives:

• Rare legitimate Ruby-based deployment pipelines that intentionally invoke PowerShell with bypass flags — verify script hash, path, and code-signing before dismissing

Tuning notes: Whitelist known internal build/release automation that legitimately spawns PowerShell from Ruby tooling by parent-child image hash pair; alert with higher priority when the parent gem package was recently updated or was previously dormant for 1+ years.

• 🔒 Long-Dormant RubyGems Package Receiving Multiple Version Bumps in 24h Window · unlock with TL Creds
• 🔒 Require-Triggered Load-Path Hijack — Ruby Process Writing to Bundler Gem Path Then Executing Interpreter · unlock with TL Creds
• 🔒 Ruby/Bundler Process Connecting to Non-Registry Host with TLS Certificate Validation Disabled · unlock with TL Creds
• 🔒 Trusted-Relationship Abuse — New Dependency Injected by Recently-Reactivated Package · unlock with TL Creds
• 🔒 Staged Payload Rollout — Rapid Sequential Version Publishes of the Same Gem · unlock with TL Creds
• 🔒 Compromised Maintainer Account — Publish Activity After Multi-Year Dormancy · unlock with TL Creds
• 🔒 RubyGems Dropper — CI/CD Fingerprinting Prior to Payload Execution (SleeperGem) · unlock with TL Creds
• 🔒 Package Manager Outbound Connection to Self-Hosted Forgejo/Disroot Infrastructure · unlock with TL Creds

Indicators of compromise for SleeperGem 574K-download gems

As of 2026-07-19, Threadlinqs Intelligence tracks 24 indicators of compromise for TL-2026-1514.

Sample indicators (1 of 24)

• Domain: git[.]disroot[.]org

Defanged, TLP:CLEAR. Full set of 24 indicators: unlock with TL Creds.

How SleeperGem 574K-download gems works

On 2026-07-18/19, attackers compromised at least two long-dormant RubyGems maintainer accounts and abused the platform's implicit trust in established package identities to distribute malware. The account 'LR-DEV' (user ID 114343), owner of both the newly created 'git_credential_manager' gem and the previously dormant 'Dendreo' gem (last legitimately updated 2020-10-24), pushed four rapid versions of git_credential_manager (2.8.0 through 2.8.3) over roughly 24 hours, iterating the payload live in production: v2.8.0 shipped a fully functional dropper; v2.8.1, released ~24 minutes later, added output suppression to /dev/null to reduce operator visibility of errors; after an ~8-hour pause, v2.8.2 wired the dropper into the gem's Ruby load path (so it fires on `require` rather than at install time) but left the execution call commented out, suggesting a staged/testing rollout; v2.8.3, ~17 minutes after that, uncommented the execution line, making the dropper live. The same account simultaneously reactivated Dendreo, a 'Simple gem for Dendreo CRM API' dormant since 2020, publishing malicious versions 1.1.3 and 1.1.4 on 2026-07-18/19. Separately, the account 'pinkroom', owner of the popular fastlane plugin 'fastlane-plugin-run_tests_firebase_testlab' (dormant since 2019, 574,661+ downloads across its lifetime), was compromised and used to publish a trojanized version 0.3.2 on 2026-07-19. The shared dropper logic downloads a binary from a public, self-hosted Forgejo git instance at git.disroot[.]org/git-ecosystem/, disables TLS certificate validation via `OpenSSL::SSL::VERIFY_NONE` to tolerate MITM/inspection or simply avoid certificate-pinning failures, then executes the retrieved payload via PowerShell on Windows or /bin/sh on Unix-like systems. Before executing, the dropper enumerates roughly 30 CI/CD-indicating environment variables (covering GitHub Actions, GitLab CI, CircleCI, Travis CI, Jenkins, and Vercel) and deliberately withholds execution when any are present — a sandbox/analysis-evasion technique that avoids the disposable, heavily monitored runners used by CI pipelines and instead targets persistent developer laptops where compromise has longer-lasting value and lower detection likelihood. VirusTotal flagged the downloaded binaries as malicious. Aikido Security disclosed the campaign, dubbed 'SleeperGem', reflecting the broader pattern (also seen recently in the RubyGems/npm/PyPI ecosystems) of attackers acquiring or compromising accounts that have been inactive for years — sometimes 6-7 years — as low-scrutiny footholds, since registries and downstream users tend to trust established publisher history over newly created ones. No CVE has been assigned; RubyGems does not track this class of incident via CVE by default, and severity is scored HIGH based on confirmed active malicious code distribution to hundreds of thousands of potential installs rather than a CVSS-rated vulnerability.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1480 Execution Guardrails; T1497 Virtualization/Sandbox Evasion

Execution

T1059 Command and Scripting Interpreter

Command and Control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer

Initial Access

T1078 Valid Accounts; T1195 Supply Chain Compromise; T1199 Trusted Relationship

Discovery

T1082 System Information Discovery

Persistence

T1554 Compromise Host Software Binary

Resource Development

T1584 Compromise Infrastructure; T1586 Compromise Accounts

Remediation for SleeperGem 574K-download gems

Patches

• No vendor patch applies; remediation is removal/downgrade to last known-clean versions: fastlane-plugin-run_tests_firebase_testlab <= 0.3.1, Dendreo <= 1.1.2, and full removal of git_credential_manager (no legitimate prior version exists)

Immediate actions

• Remove or pin away from git_credential_manager (all versions 2.8.0-2.8.3), Dendreo versions 1.1.3/1.1.4, and fastlane-plugin-run_tests_firebase_testlab 0.3.2 in any Gemfile/Gemfile.lock
• Audit CI/CD and developer-machine Gemfiles for the affected gem names and versions using `bundle list` / `gem list`
• Block outbound network access to git.disroot.org from build and developer environments pending confirmation of legitimacy of any observed connections
• Rotate any credentials, SSH keys, cloud tokens, or RubyGems API keys present on developer machines that had the affected gems installed after 2026-07-18
• Scan endpoints for the dropped binaries using VirusTotal-flagged hashes once published by Aikido/RubyGems security team

Workarounds

• Vendor/pin Gemfile.lock entries to pre-compromise versions and set up automated alerts on any Gemfile.lock diff introducing these gem names
• Run `bundle install` with network egress restricted to rubygems.org only, blocking arbitrary outbound fetches performed by installed gem code

Longer-term hardening

• Enforce lockfile pinning and checksum/hash verification for all RubyGems dependencies (bundler's `--frozen` and gemfile.lock integrity checks)
• Adopt a software composition analysis / malware-in-dependencies scanner (e.g. Aikido Safe Chain or equivalent) in CI and on developer workstations
• Treat sudden version bumps on long-dormant gems/maintainer accounts as a high-priority trust signal requiring manual review before upgrade
• Require multi-factor authentication and periodic re-verification for RubyGems maintainer accounts, especially inactive ones
• Monitor for outbound connections to unfamiliar self-hosted git/Forgejo/Gitea instances from build systems

Affected and fixed versions

• RubyGems (LR-DEV maintainer account) — git_credential_manager
  Vulnerable versions: 2.8.0; 2.8.1; 2.8.2; 2.8.3
  Fixed in: none - gem is entirely malicious, no legitimate release exists
• RubyGems (LR-DEV maintainer account) — Dendreo
  Vulnerable versions: 1.1.3; 1.1.4
  Fixed in: 1.1.2 (last known-clean version, released 2020-10-24)
• RubyGems (pinkroom maintainer account) — fastlane-plugin-run_tests_firebase_testlab
  Vulnerable versions: 0.3.2
  Fixed in: 0.3.1 (last known-clean version, released 2019-03-04)

Timeline of SleeperGem 574K-download gems

• 2019-03-04 locked-ioc-8 version 0.3.1 published by owner 'locked-ioc-22' — last legitimate release before the account went dormant for over 7 years.
• 2020-10-24 locked-ioc-23 version 1.1.2 published by owner 'locked-ioc-24' — last legitimate release before the account went dormant for nearly 6 years.
• 2026-07-18 locked-ioc-23 version 1.1.3 published by the same compromised 'locked-ioc-24' account, reactivating the long-dormant CRM API gem with malicious code.
• 2026-07-18 locked-ioc-17 version 2.8.1 published roughly 24 minutes after 2.8.0, adding output suppression to /dev/null to reduce operator error visibility.
• 2026-07-18 locked-ioc-17 version 2.8.0 published by compromised account 'locked-ioc-24' — first fully functional dropper version, a newly created gem with no legitimate prior history.
• 2026-07-19 Aikido Security publishes the 'SleeperGem' blog post disclosing the campaign, including VirusTotal detection of the dropped binaries and the locked-ioc-21 distribution infrastructure.
• 2026-07-19 locked-ioc-8 version 0.3.2 published via the separately compromised 'locked-ioc-22' maintainer account, trojanizing a plugin with 574,661+ cumulative downloads.
• 2026-07-19 locked-ioc-23 version 1.1.4 published, a further malicious update to the reactivated gem.
• 2026-07-19 locked-ioc-17 version 2.8.3 published roughly 17 minutes after 2.8.2, uncommenting the execution line and making the dropper live in the load path.
• 2026-07-19 locked-ioc-17 version 2.8.2 published after an approximately 8-hour attacker pause — dropper logic wired into the gem's Ruby load path but its execution call left commented out.

Sources cited for SleeperGem 574K-download gems

• SleeperGem: RubyGems supply chain attack aikido.dev · Vendor report · 2026-07-19
• git_credential_manager gem version history rubygems.org · Vendor report · 2026-07-19
• Dendreo gem version history rubygems.org · Vendor report · 2026-07-19
• fastlane-plugin-run_tests_firebase_testlab gem version history rubygems.org · Vendor report · 2026-07-19
• RubyGems Suspends New Signups After Hundreds of Malicious Packages Are Uploaded The Hacker News · News · 2026-05-16

Threats related to SleeperGem 574K-download gems

• SleeperGem: RubyGems Supply Chain Attack Uses Hijacked Dormant Maintainer Accounts to Weaponize git_credential_manager, Dendreo, and fastlane-plugin-run_tests_firebase_testlab
• SleeperGem Supply-Chain Campaign Uses Three Malicious RubyGems Packages to Backdoor Developer Machines
• SleeperGem: Compromised RubyGems Packages (git_credential_manager, Dendreo, fastlane-plugin-run_tests_firebase_testlab) Drop Persistent Multi-Stage Backdoor via Dormant Maintainer Accounts
• Mastra npm Supply Chain Attack: 141 @mastra/* Packages Backdoored via easy-day-js Typosquat to Deploy Cross-Platform Infostealer/RAT

Previous and next in supply chain

• Atomic Arch: Supply Chain Attack on 1,619 Arch Linux AUR Packages Deploys Rust Infostealer and eBPF Rootkit Previous report

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages