SleeperGem: Compromised RubyGems Packages (git_credential_manager, Dendreo, fastlane-plugin-run_tests_firebase_testlab) Drop Persistent Multi-Stage Backdoor via Dormant Maintainer Accounts
SleeperGem: Compromised RubyGems Packages (TL-2026-1532), also tracked as SleeperGem, is a high-severity supply-chain compromise, first published 2026-07-19. It has no confirmed attribution, affects RubyGems.org (unofficial/malicious publisher) git_credential_manager, maps to 27 MITRE ATT&CK techniques (T1036.005, T1053.003, T1059.004), and is covered by 9 detection rules and 19 indicators of compromise.
Key facts for TL-2026-1532
- Threat ID
- TL-2026-1532
- Also known as
- SleeperGem
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-07-19
- Last reviewed
- 2026-07-19
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development, devops
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 19
Attackers reactivated two long-dormant RubyGems maintainer accounts and published malicious versions of git_credential_manager, Dendreo, and fastlane-plugin-run_tests_firebase_testlab between July 18-19, 2026. The gems inject a CI-evading, multi-stage loader that fetches deploy.sh and a native binary from a Forgejo repository at git.disroot.org impersonating the git-ecosystem project, persists via a systemd user service and cron job, and — when passwordless sudo is available — drops a setuid-root shell disguised as /usr/local/sbin/ping6.
How SleeperGem: Compromised RubyGems Packages works
SleeperGem is a RubyGems software-supply-chain attack first identified and named by Aikido Security, with kill-chain telemetry independently captured by StepSecurity's Harden-Runner. The campaign is distinguished by its abuse of dormant maintainer trust: two unrelated RubyGems accounts that had been inactive for years (one tied to the Dendreo gem, dormant since 2017/2020 depending on source, and one owning the newly-created git_credential_manager namespace) were reactivated within hours of each other and used to publish poisoned releases, alongside a third, entirely unrelated maintainer account for fastlane-plugin-run_tests_firebase_testlab (574,661 cumulative downloads) whose gem was altered to add git_credential_manager as a transitive dependency, propagating the payload to its existing user base without any direct compromise of that maintainer's intent.
The git_credential_manager gem itself is a brand-new, attacker-created namespace with no corresponding tags in the legitimate git-ecosystem/git-credential-manager GitHub repository — a strong typosquat/impersonation signal, since the malicious package borrows the name and reputation of Microsoft's real Git Credential Manager project. Four versions (2.8.0-2.8.3) were published in a deliberately staged rollout: 2.8.0 landed as a functional dropper, 2.8.1 followed 24 minutes later to suppress console output that could tip off a developer, then after an approximately 8-hour gap (consistent with the attacker sleeping), 2.8.2 wired the installer directly into the gem's Ruby load path (so a bare `require 'git_credential_manager'` is sufficient to trigger execution) while commenting out the actual invocation line as a dormant staging step, and finally 2.8.3 arrived 17 minutes later with that line uncommented, fully arming the payload. This version-by-version staging suggests the operator was iterating live against test installs or CI feedback rather than shipping a single finished payload, and deliberately avoided a big-bang release that might trigger automated malicious-package scanners.
Once loaded, the payload performs environment reconnaissance by checking for roughly 30 environment variables associated with major CI/CD platforms (GITHUB_ACTIONS, GITLAB_CI, CIRCLECI, and others including Travis, Jenkins, and Vercel per cross-referenced reporting) and immediately exits if any are present. This is a purpose-built evasion of ephemeral, throwaway CI runners in favor of persistent developer workstations, where implanted access has long-term value (source code, SSH/cloud credentials, signing keys). If no CI markers are found, the Ruby process spawns a child process that reaches out over HTTPS to git.disroot.org — a public Forgejo (self-hosted Git/Gitea-alternative) instance where the attacker registered the username 'git-ecosystem' specifically to make fetched paths (https://git.disroot.org/git-ecosystem/{product}/raw/branch/main) look like an official continuation of the real git-ecosystem project. The HTTP client disables TLS certificate verification (Ruby OpenSSL::SSL::VERIFY_NONE) and sets its User-Agent header to the literal string "Git" to blend into ordinary developer tooling traffic in network logs. Two artifacts are downloaded: a shell installer script (deploy.sh) and a native binary payload.
The installer drops the daemon binary and an environment/config file at $HOME/.local/share/gcm/git-credential-manager and $HOME/.local/share/gcm/.env respectively — again borrowing the legitimate tool's 'gcm' directory naming convention for camouflage. Persistence is established redundantly through both a systemd user service (unit name: git-credential-manager) and an equivalently named cron entry, ensuring survival across reboots and session changes and providing resilience if either mechanism is discovered and removed in isolation. The installer additionally performs a local privilege-escalation probe: it checks sudo/wheel group membership, and if passwordless sudo is available, re-executes itself as root and drops a setuid-root (mode 6777) shell binary at /usr/local/sbin/ping6 — a path chosen to blend in among legitimate networking utilities (ping6 is a real, commonly-present system tool), giving the attacker an on-demand root shell from any unprivileged context without needing to re-exploit anything.
Network telemetry from StepSecurity's Harden-Runner showed a single external destination per compromised runner/host (git.disroot.org), consistent with a lean, single-C2 operation rather than a redundant multi-domain infrastructure build-out — though the use of a public, anyone-can-register Forgejo instance as C2 hosting is itself a deliberate low-cost, high-deniability infrastructure choice that complicates takedown (the instance operator did not stand up the malicious infrastructure; a single user registered a lookalike account on it). No CVE or GHSA identifier has been assigned to the malicious package publications themselves as of this writing; the RubyGems ecosystem's broader account-takeover exposure is separately tracked under GHSA-hccv-rwq6-vh79 (unauthorized gem takeover for some gems), which is relevant ecosystem context but not a 1:1 match to this specific campaign. Affected developers should treat any host that had these gem versions installed as compromised until proven otherwise, given the setuid-root escalation capability.
MITRE ATT&CK techniques used in TL-2026-1532
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1497.001 System Checks; T1564 Hide Artifacts
Persistence
T1053.003 Cron; T1505 Server Software Component; T1543.002 Systemd Service
Execution
T1059.004 Unix Shell; T1204 User Execution; T1610 Deploy Container
Discovery
T1069 Permission Groups Discovery; T1082 System Information Discovery; T1518 Software Discovery
Command and Control
T1071.001 Web Protocols; T1102 Web Service; T1105 Ingress Tool Transfer; T1573.002 Asymmetric Cryptography
Initial Access
T1195.002 Compromise Software Supply Chain; T1199 Trusted Relationship
Impact
T1499 Endpoint Denial of Service
privilege-escalation
Privilege Escalation
T1548.001 Setuid and Setgid; T1548.003 Sudo and Sudo Caching
Credential Access
T1552.001 Credentials In Files
Resource Development
T1583.006 Web Services; T1586 Compromise Accounts; T1587.001 Malware
defense-impairment
Affected products and versions in SleeperGem: Compromised RubyGems Packages
- RubyGems.org (unofficial/malicious publisher) — git_credential_manager
Vulnerable versions: 2.8.0; 2.8.1; 2.8.2; 2.8.3 - RubyGems.org (unofficial/malicious publisher) — Dendreo
Vulnerable versions: 1.1.3; 1.1.4 - RubyGems.org (unofficial/malicious publisher) — fastlane-plugin-run_tests_firebase_testlab
Vulnerable versions: 0.3.2
Remediation for SleeperGem: Compromised RubyGems Packages
Patches
- No vendor patch applicable — remediation is removal of malicious gem versions, not a supported release; monitor RubyGems.org for official yank/quarantine of the affected version numbers
Immediate actions
- Uninstall git_credential_manager 2.8.0-2.8.3, Dendreo 1.1.3-1.1.4, and fastlane-plugin-run_tests_firebase_testlab 0.3.2 from all developer workstations and CI images
- Pin Gemfiles/gemspecs to known-good versions and add these version ranges to a deny-list
- Kill and disable the systemd user service named git-credential-manager on any host that had the affected gems installed
- Remove the matching cron entry for git-credential-manager
- Delete the ~/.local/share/gcm/ directory (daemon binary and .env config)
- Inspect /usr/local/sbin/ping6 for an unexpected setuid (mode 6777) binary and remove/replace it with the legitimate ping6 if present
- Rotate all credentials, SSH keys, cloud tokens, and signing keys reachable from any affected developer machine
Workarounds
- Grep Gemfile.lock / gems.locked for vulnerable version strings: git_credential_manager (2.8.[0-3])|Dendreo (1.1.[34])|run_tests_firebase_testlab (0.3.2)
- Block outbound access to git.disroot.org from build and developer environments pending investigation
- Audit for passwordless sudo configuration on developer laptops, since it is a precondition for the setuid-root implant step
Longer-term hardening
- Deploy runtime/behavioral monitoring on developer workstations, not just CI (e.g. StepSecurity Dev Machine Guard or equivalent EDR), since this campaign specifically evades CI-only detection
- Adopt dependency pinning with lockfile hash verification and monitor for new/renamed maintainer accounts publishing to previously dormant gems
- Implement outbound network allow-listing for build/dev tooling to block unexpected destinations such as arbitrary Forgejo/Gitea instances
- Enable and monitor RubyGems maintainer 2FA and account-reactivation alerts
Weaknesses (CWE) in SleeperGem: Compromised RubyGems Packages
CWE-506, CWE-829, CWE-494, CWE-284, CWE-269
Timeline of SleeperGem: Compromised RubyGems Packages
- Dendreo maintainer account goes dormant, remaining inactive for years prior to reactivation (cross-reporting places dormancy start between 2017 and 2020)
- Earlier, related wave of poisoned Ruby Gems and Go Modules exploiting CI pipelines for credential theft is reported, and RubyGems suspends new signups after hundreds of malicious packages are uploaded, establishing the broader threat context for renewed ecosystem abuse
- git_credential_manager 2.8.1 published approximately 24 minutes after 2.8.0 to suppress console output that could alert a developer to the malicious activity
- git_credential_manager 2.8.0 published as a functional dropper by a newly created, attacker-controlled namespace with no ties to the legitimate git-ecosystem project; Dendreo 1.1.3/1.1.4 also published after being dormant since 2020
- Both Aikido Security and StepSecurity publish public blog writeups documenting the SleeperGem campaign, IOCs, and remediation guidance
- StepSecurity's Harden-Runner independently captures full kill-chain telemetry (network and process monitoring) on affected CI/build infrastructure and publishes technical writeup with persistence and privilege-escalation detail
- Aikido Security discovers and names the SleeperGem campaign, identifying the dormant-account reactivation pattern and the git.disroot.org C2 infrastructure
- git_credential_manager 2.8.3 published 17 minutes after 2.8.2, uncommenting the invocation line and fully arming the multi-stage backdoor; fastlane-plugin-run_tests_firebase_testlab 0.3.2 also published with no matching upstream GitHub tag, adding git_credential_manager as a dependency to reach its 574,661-download install base
- git_credential_manager 2.8.2 published roughly 8 hours later, wiring the installer directly into the gem's Ruby load path so a bare require triggers execution, while commenting out the actual invocation line as a staged, dormant payload
Sources cited for SleeperGem: Compromised RubyGems Packages
- SleeperGem: Compromised RubyGems Drop Persistent Backdoor
- SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts
- Overview - git-ecosystem/git-credential-manager security
- Unauthorized gem takeover for some gems (rubygems/rubygems.org advisory GHSA-hccv-rwq6-vh79)
- Poisoned Ruby Gems and Go Modules Exploit CI Pipelines for Credential Theft
- RubyGems Suspends New Signups After Hundreds of Malicious Packages Are Uploaded
- RubyGems supply chain attack: a dead drop
- Inside the RubyGems Malicious Package Flood
- Malicious Ruby Gems and Go Modules Impersonate Developer Tools to Steal Secrets and Poison CI
- RubyGems Attack Highlights Open Source Supply Chain Risks for Linux Teams
Threats related to SleeperGem: Compromised RubyGems Packages
- SleeperGem: RubyGems Supply Chain Attack Uses Hijacked Dormant Maintainer Accounts to Weaponize git_credential_manager, Dendreo, and fastlane-plugin-run_tests_firebase_testlab
- SleeperGem Supply-Chain Campaign Uses Three Malicious RubyGems Packages to Backdoor Developer Machines
- SleeperGem: RubyGems Supply Chain Attack via Compromised Dormant Maintainer Accounts
- Atomic Arch: Supply Chain Attack on 1,619 Arch Linux AUR Packages Deploys Rust Infostealer and eBPF Rootkit
- TeamPCP @antv Supply Chain Wave — Mini Shai-Hulud Multi-Ecosystem npm/GitHub Actions/VSCode Compromise
- AsyncAPI npm Supply Chain Attack: Pwn-Request GitHub Actions Compromise Deploys Miasma Tasking Framework
Detection coverage for TL-2026-1532
As of 2026-07-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1532 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.