# SleeperGem: RubyGems Supply Chain Attack via Compromised Dormant Maintainer Accounts

> Two dormant RubyGems maintainer accounts (LR-DEV and pinkroom) were compromised and used to publish/update trusted gems — git_credential_manager, Dendreo, and fastlane-plugin-run_tests_firebase_testlab (574,661+ cumulative downloads) — with a dropper that disables SSL certificate verification, fingerprints CI/CD environments to avoid disposable analysis runners, and executes PowerShell or shell payloads on developer machines that survive.

- **Published:** 2026-07-19T00:00:00Z
- **Last reviewed:** 2026-07-19T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1514
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-sleepergem-574k-download-gems-tl-2026-1514.webp?v=febecfa6 (Threadlinqs threat intel: SleeperGem 574K-Download RubyGems: Detection & IOCs (TL-2026-1514) — High severity, 24 IOCs, 9 detection rules.)
- **ID:** TL-2026-1514
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 24 (1 shown free below)

## Description

On 2026-07-18/19, attackers compromised at least two long-dormant RubyGems maintainer accounts and abused the platform's implicit trust in established package identities to distribute malware. The account 'LR-DEV' (user ID 114343), owner of both the newly created 'git_credential_manager' gem and the previously dormant 'Dendreo' gem (last legitimately updated 2020-10-24), pushed four rapid versions of git_credential_manager (2.8.0 through 2.8.3) over roughly 24 hours, iterating the payload live in production: v2.8.0 shipped a fully functional dropper; v2.8.1, released ~24 minutes later, added output suppression to /dev/null to reduce operator visibility of errors; after an ~8-hour pause, v2.8.2 wired the dropper into the gem's Ruby load path (so it fires on `require` rather than at install time) but left the execution call commented out, suggesting a staged/testing rollout; v2.8.3, ~17 minutes after that, uncommented the execution line, making the dropper live. The same account simultaneously reactivated Dendreo, a 'Simple gem for Dendreo CRM API' dormant since 2020, publishing malicious versions 1.1.3 and 1.1.4 on 2026-07-18/19. Separately, the account 'pinkroom', owner of the popular fastlane plugin 'fastlane-plugin-run_tests_firebase_testlab' (dormant since 2019, 574,661+ downloads across its lifetime), was compromised and used to publish a trojanized version 0.3.2 on 2026-07-19. The shared dropper logic downloads a binary from a public, self-hosted Forgejo git instance at git.disroot[.]org/git-ecosystem/, disables TLS certificate validation via `OpenSSL::SSL::VERIFY_NONE` to tolerate MITM/inspection or simply avoid certificate-pinning failures, then executes the retrieved payload via PowerShell on Windows or /bin/sh on Unix-like systems. Before executing, the dropper enumerates roughly 30 CI/CD-indicating environment variables (covering GitHub Actions, GitLab CI, CircleCI, Travis CI, Jenkins, and Vercel) and deliberately withholds execution when any are present — a sandbox/analysis-evasion technique that avoids the disposable, heavily monitored runners used by CI pipelines and instead targets persistent developer laptops where compromise has longer-lasting value and lower detection likelihood. VirusTotal flagged the downloaded binaries as malicious. Aikido Security disclosed the campaign, dubbed 'SleeperGem', reflecting the broader pattern (also seen recently in the RubyGems/npm/PyPI ecosystems) of attackers acquiring or compromising accounts that have been inactive for years — sometimes 6-7 years — as low-scrutiny footholds, since registries and downstream users tend to trust established publisher history over newly created ones. No CVE has been assigned; RubyGems does not track this class of incident via CVE by default, and severity is scored HIGH based on confirmed active malicious code distribution to hundreds of thousands of potential installs rather than a CVSS-rated vulnerability.

## MITRE ATT&CK

- T1586 Compromise Accounts
- T1584 Compromise Infrastructure
- T1195 Supply Chain Compromise
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1554 Compromise Host Software Binary
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1480 Execution Guardrails
- T1082 System Information Discovery
- T1105 Ingress Tool Transfer
- T1071 Application Layer Protocol
- T1036 Masquerading
- T1199 Trusted Relationship

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Ruby Toolchain Spawning PowerShell/Shell with Bypass Flags (SleeperGem Dropper Execution)** (`TL-2026-1514-SPL-002`)

Detects a ruby/gem/bundle/rake process spawning powershell.exe with -ExecutionPolicy Bypass, or /bin/sh executing a script from a temp directory, matching the exact SleeperGem dropper execution strings (`powershell -ExecutionPolicy bypass "#{full_path}"` / `/bin/sh "#{full_path}"`) that fire when a require-triggered load-path hook (git_credential_manager 2.8.2/2.8.3) runs its payload.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1554, T1059.001, T1059.004, T1036.005
- **Data sources:** sysmon, windows_security, device_process_events, edr_process_telemetry
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval parent=lower(ParentImage)
| eval child=lower(Image)
| where match(parent, "(ruby|gem|bundle|rake)(\.exe)?$")
| where match(child, "powershell\.exe$") OR match(child, "sh$")
| where match(CommandLine, "(?i)-executionpolicy\s+bypass") OR match(CommandLine, "(?i)/tmp/|/temp/|%temp%")
| stats count min(_time) as first_seen max(_time) as last_seen by host, User, ParentImage, Image, CommandLine
| table first_seen, last_seen, host, User, ParentImage, Image, CommandLine, count
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName has_any ("ruby", "gem", "bundle", "rake")
| where (FileName =~ "powershell.exe" and ProcessCommandLine has "-ExecutionPolicy" and ProcessCommandLine has "Bypass")
    or (FileName in ("sh", "/bin/sh") and ProcessCommandLine has_any ("/tmp/", "temp"))
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| order by Timestamp desc
```

### Sigma

```yaml
title: Ruby Toolchain Spawning PowerShell or Shell with Execution-Policy Bypass
id: 6b9d4e33-1514-4b02-8f22-sleepergem002
status: experimental
description: Detects a Ruby/gem/bundle/rake process spawning powershell.exe with -ExecutionPolicy Bypass or /bin/sh against a temp-directory script, matching the SleeperGem dropper's exact post-require execution pattern.
references:
    - https://www.aikido.dev/blog/sleepergem-rubygems-supply-chain-attack
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-19
tags:
    - attack.persistence
    - attack.t1554
    - attack.execution
    - attack.t1059.001
    - attack.t1059.004
    - attack.defense-evasion
    - attack.t1036.005
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\ruby.exe'
            - '\rake.exe'
            - '\bundle.exe'
            - '\gem.exe'
    selection_child:
        Image|endswith: '\powershell.exe'
        CommandLine|contains|all:
            - '-ExecutionPolicy'
            - 'Bypass'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate Ruby-invoked deployment or build scripts that intentionally shell out to PowerShell (rare; verify script path, publisher, and signing)
level: high
```

**Known false positives:**

- Rare legitimate Ruby-based deployment pipelines that intentionally invoke PowerShell with bypass flags — verify script hash, path, and code-signing before dismissing

**Tuning notes:** Whitelist known internal build/release automation that legitimately spawns PowerShell from Ruby tooling by parent-child image hash pair; alert with higher priority when the parent gem package was recently updated or was previously dormant for 1+ years.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Long-Dormant RubyGems Package Receiving Multiple Version Bumps in 24h Window (locked: unlock with TL Creds)
- Require-Triggered Load-Path Hijack — Ruby Process Writing to Bundler Gem Path Then Executing Interpreter (locked: unlock with TL Creds)
- Ruby/Bundler Process Connecting to Non-Registry Host with TLS Certificate Validation Disabled (locked: unlock with TL Creds)
- Trusted-Relationship Abuse — New Dependency Injected by Recently-Reactivated Package (locked: unlock with TL Creds)
- Staged Payload Rollout — Rapid Sequential Version Publishes of the Same Gem (locked: unlock with TL Creds)
- Compromised Maintainer Account — Publish Activity After Multi-Year Dormancy (locked: unlock with TL Creds)
- RubyGems Dropper — CI/CD Fingerprinting Prior to Payload Execution (SleeperGem) (locked: unlock with TL Creds)
- Package Manager Outbound Connection to Self-Hosted Forgejo/Disroot Infrastructure (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 24)

Defanged, TLP:CLEAR.

- Domain: `git[.]disroot[.]org`

Full set of 24 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [SleeperGem: RubyGems supply chain attack](https://www.aikido.dev/blog/sleepergem-rubygems-supply-chain-attack)
- [git_credential_manager gem version history](https://rubygems.org/gems/git_credential_manager)
- [Dendreo gem version history](https://rubygems.org/gems/Dendreo)
- [fastlane-plugin-run_tests_firebase_testlab gem version history](https://rubygems.org/gems/fastlane-plugin-run_tests_firebase_testlab)
- [RubyGems Suspends New Signups After Hundreds of Malicious Packages Are Uploaded](https://thehackernews.com/2026/05/rubygems-suspends-new-signups-after.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1514