SleeperGem Supply-Chain Campaign Uses Three Malicious RubyGems Packages to Backdoor Developer Machines
SleeperGem Supply-Chain Campaign Uses Three Malicious (TL-2026-1575), also tracked as SleeperGem, is a high-severity supply-chain compromise scored CVSS 8.1, first published 2026-07-20. It has no confirmed attribution, affects RubyGems.org (community package registry) git_credential_manager, maps to 25 MITRE ATT&CK techniques (T1036.003, T1036.005, T1053.003), and is covered by 9 detection rules and 21 indicators of compromise.
Key facts for TL-2026-1575
- Threat ID
- TL-2026-1575
- Also known as
- SleeperGem
- Severity
- HIGH
- CVSS
- 8.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-07-20
- Last reviewed
- 2026-07-20
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 21
The SleeperGem campaign hijacked two long-dormant RubyGems maintainer accounts and used them to publish trojanized releases of git_credential_manager (impersonating Microsoft's official tool), Dendreo, and fastlane-plugin-run_tests_firebase_testlab. Each malicious release is a loader that fetches a second-stage deploy.sh and native daemon from an attacker-controlled Forgejo instance, deliberately skips execution on ~30 recognized CI/CD environment variables to avoid disposable build runners, and installs dual persistence (systemd user service + cron) plus a setuid root shell backdoor on genuine developer laptops.
How SleeperGem Supply-Chain Campaign Uses Three Malicious works
Between July 18 and July 19, 2026, threat actors published malicious versions of three RubyGems packages to the public RubyGems.org registry in a coordinated software supply-chain attack that researchers at Aikido Security named SleeperGem. The name reflects the campaign's core tradecraft: rather than typosquatting or registering new packages, the attackers hijacked two ordinary RubyGems maintainer accounts that had gone quiet for six to seven years -- accounts that "looked harmless enough to hijack without anyone noticing," per Aikido researcher Charlie Eriksen. Once in control, the attackers pushed new releases of Dendreo (v1.1.3, v1.1.4, last legitimately updated 2020) and fastlane-plugin-run_tests_firebase_testlab (v0.3.2, last legitimately updated 2019), and separately published four new versions of a package named git_credential_manager (v2.8.0-2.8.3) that impersonates Microsoft's official Git Credential Manager tool. The git_credential_manager releases shipped within roughly nine hours across two working sessions: a 24-minute gap between v2.8.0 and v2.8.1, an 8-hour sleep, then a 17-minute gap between v2.8.2 and the final v2.8.3 activation release -- behavior consistent with an operator iterating live against telemetry. The malicious gem was also added as a dependency to at least five downstream packages (Dendreo, fastlane-plugin-run_tests_firebase_testlab, slackHtmlToMarkdown, seo_optimizer, array_fast_methods), and fastlane-plugin-run_tests_firebase_testlab alone carried a total download count of 574,661, giving the campaign a substantial installed footprint despite the packages' age. On require, each trojanized gem spawns a child Ruby process that shells out to an install script. The script disables TLS verification (OpenSSL::SSL::VERIFY_NONE) and issues an HTTPS request with a 'Git' User-Agent to an attacker-controlled Forgejo instance at git.disroot.org under the repository namespace 'git-ecosystem', using the URL pattern https://git.disroot.org/git-ecosystem/#{product}/raw/branch/main. Before doing anything further, the script performs a skip_install check that enumerates roughly 30 environment variables associated with CI/CD platforms -- including GITHUB_ACTIONS, GITLAB_CI, CIRCLECI, plus Travis, Jenkins, and Vercel indicators -- and silently exits if any are present. This is a deliberate anti-analysis and targeting control: the operators want persistent footholds on human-operated developer laptops and long-lived build hosts, not disposable, ephemeral CI runners that would be destroyed at job completion and yield no lasting access. On a genuine developer machine, the loader downloads a second-stage shell script (deploy.sh) and a native binary masquerading as a Git Credential Manager helper (Windows delivery uses PowerShell with -ExecutionPolicy bypass; Unix delivery uses /bin/sh). The binary is copied to ~/.local/share/gcm/git-credential-manager with an accompanying ~/.local/share/gcm/.env configuration file, marked executable, and launched as a resident daemon. Persistence is installed twice -- via a systemd user service and a cron entry, both deliberately labeled 'git-credential-manager' so that removing one persistence mechanism leaves the other intact and silently respawns the daemon on reboot or session start. The malware then probes group membership for sudo or wheel; where passwordless sudo is available it re-executes as root and plants a setuid (mode 6777) copy of the system shell disguised as a networking utility at /usr/local/sbin/ping6, providing a durable, camouflaged root escalation path independent of the original daemon. StepSecurity, running the malicious releases inside their Harden-Runner sandboxing tool, captured and confirmed the full kill chain end-to-end. No CVE or GHSA identifier has been assigned to this campaign as of the current reporting; RubyGems.org and downstream mirrors are the primary distribution vector. Affected users are advised to treat any machine that installed the trojanized gems -- and every credential and secret that touched that machine -- as fully compromised, remove the daemon directory and both persistence mechanisms, hunt for the setuid shell at /usr/local/sbin/ping6, and rotate all credentials.
MITRE ATT&CK techniques used in TL-2026-1575
Defense Evasion
T1036.003 Rename Legitimate Utilities; T1036.005 Match Legitimate Resource Name or Location; T1497.001 System Checks; T1564.001 Hidden Files and Directories
Persistence
T1053.003 Cron; T1543.002 Systemd Service
Privilege Escalation
T1053.003 Cron; T1548.001 Setuid and Setgid; T1548.003 Sudo and Sudo Caching
Execution
T1059.001 PowerShell; T1059.004 Unix Shell; T1204.003 Malicious Image
Discovery
T1069.001 Local Groups; T1082 System Information Discovery; T1518 Software Discovery
Command and Control
T1071.001 Web Protocols; T1102 Web Service; T1105 Ingress Tool Transfer
Initial Access
T1195.002 Compromise Software Supply Chain; T1199 Trusted Relationship
Impact
T1486 Data Encrypted for Impact
privilege-escalation
Credential Access
T1552.001 Credentials In Files
Resource Development
T1583.004 Server; T1586 Compromise Accounts; T1608.001 Upload Malware
defense-impairment
Affected products and versions in SleeperGem Supply-Chain Campaign Uses Three Malicious
- RubyGems.org (community package registry) — git_credential_manager (malicious/impersonating gem)
Vulnerable versions: 2.8.0; 2.8.1; 2.8.2; 2.8.3 - RubyGems.org (community package registry) — Dendreo
Vulnerable versions: 1.1.3; 1.1.4 - RubyGems.org (community package registry) — fastlane-plugin-run_tests_firebase_testlab
Vulnerable versions: 0.3.2
Remediation for SleeperGem Supply-Chain Campaign Uses Three Malicious
Patches
- No patched version exists; the underlying packages were never legitimate -- affected versions must be fully removed, not upgraded
Immediate actions
- Treat any machine that installed git_credential_manager (2.8.0-2.8.3), Dendreo (1.1.3, 1.1.4), or fastlane-plugin-run_tests_firebase_testlab (0.3.2) as fully compromised
- Remove the dropped daemon and configuration at ~/.local/share/gcm/ (git-credential-manager binary and .env file)
- Kill and remove the systemd user service named 'git-credential-manager' (both the unit file and running process)
- Inspect crontab for the 'git-credential-manager' entry and remove it -- do not stop at removing only one of the two persistence mechanisms
- Hunt for and delete the setuid (mode 6777) root shell backdoor disguised at /usr/local/sbin/ping6
- Block outbound access to git.disroot.org/git-ecosystem/* at the network egress layer pending full incident review
- Rotate all credentials, tokens, and secrets that were present on or accessible from the affected machine, including Git/CI/CD credentials
Workarounds
- Pin RubyGems dependencies to previously known-good versions and disable automatic minor/patch updates for these package names pending registry remediation
Longer-term hardening
- Deploy dependency-confusion and typosquat/impersonation monitoring for developer tooling package names (e.g. git_credential_manager) across all package ecosystems in use
- Adopt allow-listed, pinned, and hash-verified dependency installation for build and developer environments
- Monitor for anomalous outbound connections from developer laptops to code-forge/Forgejo/Gitea hosts not used by the organization
- Require MFA and activity-based re-verification for package maintainer accounts, especially long-dormant ones, at the registry level (RubyGems.org)
- Run untrusted or newly-installed developer tooling gems under sandboxed/Harden-Runner-style execution before general rollout
Weaknesses (CWE) in SleeperGem Supply-Chain Campaign Uses Three Malicious
CWE-506, CWE-494, CWE-269, CWE-732
Timeline of SleeperGem Supply-Chain Campaign Uses Three Malicious
- Dendreo gem originally published to RubyGems.org as a legitimate package.
- fastlane-plugin-run_tests_firebase_testlab originally published to RubyGems.org, maintained by account 'pinkroom'.
- fastlane-plugin-run_tests_firebase_testlab receives its last legitimate update before going dormant for years.
- Dendreo receives its last legitimate update before going dormant.
- The Hacker News publishes public reporting summarizing the SleeperGem campaign for a general security audience.
- git_credential_manager v2.8.1 published approximately 24 minutes after v2.8.0.
- First malicious version (git_credential_manager v2.8.0) published to RubyGems.org, impersonating Microsoft's official Git Credential Manager tool.
- git_credential_manager v2.8.3 published 17 minutes after v2.8.2, believed to be the final activation release; Dendreo v1.1.3/v1.1.4 and fastlane-plugin-run_tests_firebase_testlab v0.3.2 also pushed via the two hijacked dormant maintainer accounts during this window.
- git_credential_manager v2.8.2 published following an approximately 8-hour operator sleep period.
- Aikido Security researcher Charlie Eriksen publicly discloses and names the campaign 'SleeperGem', detailing the dormant-account-hijacking tradecraft.
- StepSecurity publishes detailed technical kill-chain analysis after running the malicious releases under its Harden-Runner sandbox.
Sources cited for SleeperGem Supply-Chain Campaign Uses Three Malicious
- SleeperGem Uses Three Malicious RubyGems Packages to Backdoor Developer Machines
- SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor
- SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts
- SleeperGem RubyGems attack evades CI to hit developer laptops
- SleeperGem attack targets Ruby ecosystem with malicious gems
- Supply Chain Vulnerability in RubyGems Highlights Growing Software Security Risks
Threats related to SleeperGem Supply-Chain Campaign Uses Three Malicious
- SleeperGem: RubyGems Supply Chain Attack Uses Hijacked Dormant Maintainer Accounts to Weaponize git_credential_manager, Dendreo, and fastlane-plugin-run_tests_firebase_testlab
- SleeperGem: Compromised RubyGems Packages (git_credential_manager, Dendreo, fastlane-plugin-run_tests_firebase_testlab) Drop Persistent Multi-Stage Backdoor via Dormant Maintainer Accounts
- SleeperGem: RubyGems Supply Chain Attack via Compromised Dormant Maintainer Accounts
- AsyncAPI npm Supply Chain Attack: Pwn-Request GitHub Actions Compromise Deploys Miasma Tasking Framework
- jscrambler npm Package Supply Chain Compromise (v8.14.0 Malicious Release)
- JDownloader Website Supply Chain Compromise — Trojanized Windows/Linux Installers Deploy Pyarmor-Obfuscated Python RAT (May 6-7, 2026)
Detection coverage for TL-2026-1575
As of 2026-07-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1575 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.