SleeperGem: RubyGems Supply Chain Attack via Compromised Dormant Maintainer Accounts
SleeperGem: RubyGems Supply Chain Attack via Compromised (TL-2026-1514), also tracked as SleeperGem, is a high-severity supply-chain compromise, first published 2026-07-19. It has no confirmed attribution, affects RubyGems (LR-DEV maintainer account) git_credential_manager, maps to 14 MITRE ATT&CK techniques (T1027, T1036, T1059), and is covered by 9 detection rules and 24 indicators of compromise.
Key facts for TL-2026-1514
- Threat ID
- TL-2026-1514
- Also known as
- SleeperGem
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-07-19
- Last reviewed
- 2026-07-19
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, softwaredevelopment, devops
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 24
Two dormant RubyGems maintainer accounts (LR-DEV and pinkroom) were compromised and used to publish/update trusted gems — git_credential_manager, Dendreo, and fastlane-plugin-run_tests_firebase_testlab (574,661+ cumulative downloads) — with a dropper that disables SSL certificate verification, fingerprints CI/CD environments to avoid disposable analysis runners, and executes PowerShell or shell payloads on developer machines that survive.
How SleeperGem: RubyGems Supply Chain Attack via Compromised works
On 2026-07-18/19, attackers compromised at least two long-dormant RubyGems maintainer accounts and abused the platform's implicit trust in established package identities to distribute malware. The account 'LR-DEV' (user ID 114343), owner of both the newly created 'git_credential_manager' gem and the previously dormant 'Dendreo' gem (last legitimately updated 2020-10-24), pushed four rapid versions of git_credential_manager (2.8.0 through 2.8.3) over roughly 24 hours, iterating the payload live in production: v2.8.0 shipped a fully functional dropper; v2.8.1, released ~24 minutes later, added output suppression to /dev/null to reduce operator visibility of errors; after an ~8-hour pause, v2.8.2 wired the dropper into the gem's Ruby load path (so it fires on `require` rather than at install time) but left the execution call commented out, suggesting a staged/testing rollout; v2.8.3, ~17 minutes after that, uncommented the execution line, making the dropper live. The same account simultaneously reactivated Dendreo, a 'Simple gem for Dendreo CRM API' dormant since 2020, publishing malicious versions 1.1.3 and 1.1.4 on 2026-07-18/19. Separately, the account 'pinkroom', owner of the popular fastlane plugin 'fastlane-plugin-run_tests_firebase_testlab' (dormant since 2019, 574,661+ downloads across its lifetime), was compromised and used to publish a trojanized version 0.3.2 on 2026-07-19. The shared dropper logic downloads a binary from a public, self-hosted Forgejo git instance at git.disroot[.]org/git-ecosystem/, disables TLS certificate validation via `OpenSSL::SSL::VERIFY_NONE` to tolerate MITM/inspection or simply avoid certificate-pinning failures, then executes the retrieved payload via PowerShell on Windows or /bin/sh on Unix-like systems. Before executing, the dropper enumerates roughly 30 CI/CD-indicating environment variables (covering GitHub Actions, GitLab CI, CircleCI, Travis CI, Jenkins, and Vercel) and deliberately withholds execution when any are present — a sandbox/analysis-evasion technique that avoids the disposable, heavily monitored runners used by CI pipelines and instead targets persistent developer laptops where compromise has longer-lasting value and lower detection likelihood. VirusTotal flagged the downloaded binaries as malicious. Aikido Security disclosed the campaign, dubbed 'SleeperGem', reflecting the broader pattern (also seen recently in the RubyGems/npm/PyPI ecosystems) of attackers acquiring or compromising accounts that have been inactive for years — sometimes 6-7 years — as low-scrutiny footholds, since registries and downstream users tend to trust established publisher history over newly created ones. No CVE has been assigned; RubyGems does not track this class of incident via CVE by default, and severity is scored HIGH based on confirmed active malicious code distribution to hundreds of thousands of potential installs rather than a CVSS-rated vulnerability.
MITRE ATT&CK techniques used in TL-2026-1514
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1480 Execution Guardrails; T1497 Virtualization/Sandbox Evasion
Execution
T1059 Command and Scripting Interpreter
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer
Initial Access
T1078 Valid Accounts; T1195 Supply Chain Compromise; T1199 Trusted Relationship
Discovery
T1082 System Information Discovery
Persistence
T1554 Compromise Host Software Binary
Resource Development
Affected products and versions in SleeperGem: RubyGems Supply Chain Attack via Compromised
- RubyGems (LR-DEV maintainer account) — git_credential_manager
Vulnerable versions: 2.8.0; 2.8.1; 2.8.2; 2.8.3
Fixed in: none - gem is entirely malicious, no legitimate release exists - RubyGems (LR-DEV maintainer account) — Dendreo
Vulnerable versions: 1.1.3; 1.1.4
Fixed in: 1.1.2 (last known-clean version, released 2020-10-24) - RubyGems (pinkroom maintainer account) — fastlane-plugin-run_tests_firebase_testlab
Vulnerable versions: 0.3.2
Fixed in: 0.3.1 (last known-clean version, released 2019-03-04)
Remediation for SleeperGem: RubyGems Supply Chain Attack via Compromised
Patches
- No vendor patch applies; remediation is removal/downgrade to last known-clean versions: fastlane-plugin-run_tests_firebase_testlab <= 0.3.1, Dendreo <= 1.1.2, and full removal of git_credential_manager (no legitimate prior version exists)
Immediate actions
- Remove or pin away from git_credential_manager (all versions 2.8.0-2.8.3), Dendreo versions 1.1.3/1.1.4, and fastlane-plugin-run_tests_firebase_testlab 0.3.2 in any Gemfile/Gemfile.lock
- Audit CI/CD and developer-machine Gemfiles for the affected gem names and versions using `bundle list` / `gem list`
- Block outbound network access to git.disroot.org from build and developer environments pending confirmation of legitimacy of any observed connections
- Rotate any credentials, SSH keys, cloud tokens, or RubyGems API keys present on developer machines that had the affected gems installed after 2026-07-18
- Scan endpoints for the dropped binaries using VirusTotal-flagged hashes once published by Aikido/RubyGems security team
Workarounds
- Vendor/pin Gemfile.lock entries to pre-compromise versions and set up automated alerts on any Gemfile.lock diff introducing these gem names
- Run `bundle install` with network egress restricted to rubygems.org only, blocking arbitrary outbound fetches performed by installed gem code
Longer-term hardening
- Enforce lockfile pinning and checksum/hash verification for all RubyGems dependencies (bundler's `--frozen` and gemfile.lock integrity checks)
- Adopt a software composition analysis / malware-in-dependencies scanner (e.g. Aikido Safe Chain or equivalent) in CI and on developer workstations
- Treat sudden version bumps on long-dormant gems/maintainer accounts as a high-priority trust signal requiring manual review before upgrade
- Require multi-factor authentication and periodic re-verification for RubyGems maintainer accounts, especially inactive ones
- Monitor for outbound connections to unfamiliar self-hosted git/Forgejo/Gitea instances from build systems
Weaknesses (CWE) in SleeperGem: RubyGems Supply Chain Attack via Compromised
CWE-506, CWE-829, CWE-295
Timeline of SleeperGem: RubyGems Supply Chain Attack via Compromised
- fastlane-plugin-run_tests_firebase_testlab version 0.3.1 published by owner 'pinkroom' — last legitimate release before the account went dormant for over 7 years.
- Dendreo version 1.1.2 published by owner 'LR-DEV' — last legitimate release before the account went dormant for nearly 6 years.
- Dendreo version 1.1.3 published by the same compromised 'LR-DEV' account, reactivating the long-dormant CRM API gem with malicious code.
- git_credential_manager version 2.8.1 published roughly 24 minutes after 2.8.0, adding output suppression to /dev/null to reduce operator error visibility.
- git_credential_manager version 2.8.0 published by compromised account 'LR-DEV' — first fully functional dropper version, a newly created gem with no legitimate prior history.
- Aikido Security publishes the 'SleeperGem' blog post disclosing the campaign, including VirusTotal detection of the dropped binaries and the git.disroot.org distribution infrastructure.
- fastlane-plugin-run_tests_firebase_testlab version 0.3.2 published via the separately compromised 'pinkroom' maintainer account, trojanizing a plugin with 574,661+ cumulative downloads.
- Dendreo version 1.1.4 published, a further malicious update to the reactivated gem.
- git_credential_manager version 2.8.3 published roughly 17 minutes after 2.8.2, uncommenting the execution line and making the dropper live in the load path.
- git_credential_manager version 2.8.2 published after an approximately 8-hour attacker pause — dropper logic wired into the gem's Ruby load path but its execution call left commented out.
Sources cited for SleeperGem: RubyGems Supply Chain Attack via Compromised
Threats related to SleeperGem: RubyGems Supply Chain Attack via Compromised
- SleeperGem: RubyGems Supply Chain Attack Uses Hijacked Dormant Maintainer Accounts to Weaponize git_credential_manager, Dendreo, and fastlane-plugin-run_tests_firebase_testlab
- SleeperGem Supply-Chain Campaign Uses Three Malicious RubyGems Packages to Backdoor Developer Machines
- SleeperGem: Compromised RubyGems Packages (git_credential_manager, Dendreo, fastlane-plugin-run_tests_firebase_testlab) Drop Persistent Multi-Stage Backdoor via Dormant Maintainer Accounts
- Mastra npm Supply Chain Attack: 141 @mastra/* Packages Backdoored via easy-day-js Typosquat to Deploy Cross-Platform Infostealer/RAT
Detection coverage for TL-2026-1514
As of 2026-07-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1514 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.