SleeperGem: RubyGems Supply Chain Attack Uses Hijacked Dormant Maintainer Accounts to Weaponize git_credential_manager, Dendreo, and fastlane-plugin-run_tests_firebase_testlab
SleeperGem: RubyGems Supply Chain Attack Uses Hijacked (TL-2026-1703), also tracked as SleeperGem, is a high-severity supply-chain compromise, first published 2026-07-26. It has no confirmed attribution, affects RubyGems.org (community package) git_credential_manager (RubyGem), maps to 17 MITRE ATT&CK techniques (T1036.005, T1053.003, T1059.001), and is covered by 9 detection rules and 25 indicators of compromise.
Key facts for TL-2026-1703
- Threat ID
- TL-2026-1703
- Also known as
- SleeperGem
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-07-26
- Last reviewed
- 2026-07-26
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, softwaredevelopment
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 25
Malware and tooling in SleeperGem: RubyGems Supply Chain Attack Uses Hijacked
Malware and tooling: Forgejo
Between July 18-19, 2026, attackers took over at least two RubyGems maintainer accounts dormant since 2019 and published a fake git_credential_manager gem that impersonates Microsoft's official Git Credential Manager, iterating across four releases in nine hours until version 2.8.3 auto-executed a persistent backdoor on a bare `require`. The gem was then added as a dependency of five other dormant gems (dendreo, fastlane-plugin-run_tests_firebase_testlab, slackHtmlToMarkdown, seo_optimizer, array_fast_methods) to reach their existing install bases, while the malware's ~30-variable CI/CD fingerprint check deliberately steered the attack away from build servers and onto developer laptops.
How SleeperGem: RubyGems Supply Chain Attack Uses Hijacked works
SleeperGem is a RubyGems software-supply-chain campaign, first reported by Wiz Threats and independently analyzed by Aikido Security and StepSecurity, in which attackers compromised long-inactive RubyGems maintainer accounts (dormant since 2019) rather than compromising infrastructure or exploiting a code vulnerability. Using this access, they published a brand-new gem named `git_credential_manager` that impersonates the real, widely-trusted Microsoft Git Credential Manager tool by name alone.
Over a nine-hour window on July 18-19, 2026, the attackers iterated the gem through four published versions, progressively weaponizing it: 2.8.0 was a working dropper that used `Process.spawn` to invoke `powershell -ExecutionPolicy bypass` on Windows or `/bin/sh` on Unix after fetching a payload; 2.8.1 suppressed Unix console output to reduce the chance a developer would notice; 2.8.2 relocated the malicious call into the gem's `require()` load path but left the execution line staged/commented out; and 2.8.3 removed that safety, so the full attack chain now fires automatically the moment any Ruby process merely requires the library, with no explicit `gem install` or invocation needed.
Technically, the loader constructs download URLs of the form `https://git.disroot.org/git-ecosystem/{product}/raw/branch/main` against a public Forgejo (self-hosted Git service) instance, using a deceptive account named `git-ecosystem` to appear ecosystem-adjacent rather than attacker-owned. Before downloading, the code sets `http.verify_mode = OpenSSL::SSL::VERIFY_NONE`, explicitly disabling TLS certificate validation, and spoofs its User-Agent to the bare string "Git". It fetches a `deploy.sh` shell script and a native binary named identically to the impersonated tool. `deploy.sh` copies the binary to `~/.local/share/gcm/git-credential-manager`, makes it executable, drops a config file at `~/.local/share/gcm/.env`, and launches it with a `--daemon` flag - deliberately relocating the payload outside the gem's own install directory so a simple `gem uninstall` does not remove it. Persistence is established redundantly via a systemd `--user` service unit named `git-credential-manager` and a matching cron entry. The malware also probes sudo/wheel group membership; where passwordless sudo is available it re-executes as root and plants a setuid (mode 6777) backdoor shell at `/usr/local/sbin/ping6`.
Before fetching or executing anything, the second stage checks roughly 30 environment variables associated with CI/CD platforms (GitHub Actions, GitLab CI, CircleCI, Travis CI, Jenkins, Vercel) and exits immediately if any are present - a deliberate design choice to avoid detection on short-lived, monitored build infrastructure and instead persist on long-lived developer workstations where secrets (SSH keys, cloud/API tokens, Git credentials, browser session material) accumulate over time.
To spread beyond direct installs of the fake gem, the attackers added `git_credential_manager` as a dependency of five previously-legitimate, long-dormant gems they also controlled: `dendreo` (originally published 2017, republished as 1.1.3/1.1.4), `fastlane-plugin-run_tests_firebase_testlab` (originally published 2018, ~574,661 cumulative downloads, republished as 0.3.2, maintainer account `pinkroom`), and three further packages - `slackHtmlToMarkdown`, `seo_optimizer`, and `array_fast_methods` (maintainer account `LR-DEV`, which controlled four of the five dependent gems). This let the malicious code reach each package's existing downstream users through an ordinary dependency-version bump rather than requiring a direct, conspicuous install of an unfamiliar package.
The malicious releases were yanked from RubyGems.org following disclosure. No CVE, GHSA, or OSV identifier had been assigned as of this research, and no threat actor has been publicly attributed; researchers (notably Aikido's Charlie Eriksen) frame the core innovation as targeting accounts dormant for 6-7 years specifically because such accounts appear unthreatening to registry operators and consumers alike, while still retaining full publish rights.
MITRE ATT&CK techniques used in TL-2026-1703
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location; T1497.001 System Checks
Persistence
T1053.003 Cron; T1543.002 Systemd Service
Execution
T1059.001 PowerShell; T1059.004 Unix Shell
Discovery
T1069.001 Local Groups; T1082 System Information Discovery
Command and Control
T1071.001 Web Protocols; T1102 Web Service; T1105 Ingress Tool Transfer
Initial Access
T1195.001 Compromise Software Dependencies and Development Tools
Privilege Escalation
T1548.001 Setuid and Setgid; T1548.003 Sudo and Sudo Caching
defense-impairment
Resource Development
Affected products and versions in SleeperGem: RubyGems Supply Chain Attack Uses Hijacked
- RubyGems.org (community package) — git_credential_manager (RubyGem)
Vulnerable versions: 2.8.0; 2.8.1; 2.8.2; 2.8.3
Fixed in: N/A - entire gem is malicious/impersonating Microsoft Git Credential Manager; package yanked from RubyGems.org, no legitimate release exists under this gem name - RubyGems.org (community package) — dendreo (RubyGem)
Vulnerable versions: 1.1.3; 1.1.4
Fixed in: Revert to pre-2026-07-18 legitimate releases and verify checksums; malicious releases yanked from RubyGems.org - RubyGems.org (community package) — fastlane-plugin-run_tests_firebase_testlab (RubyGem)
Vulnerable versions: 0.3.2 (compromised republish)
Fixed in: Revert to pre-2026-07-18 legitimate release and verify checksums; malicious release yanked from RubyGems.org
Remediation for SleeperGem: RubyGems Supply Chain Attack Uses Hijacked
Patches
- No vendor patch applies - remediation is removal of the malicious gem versions (git_credential_manager 2.8.0-2.8.3; the compromised dendreo 1.1.3-1.1.4 and fastlane-plugin-run_tests_firebase_testlab 0.3.2 releases), which have been yanked from RubyGems.org
Immediate actions
- Uninstall git_credential_manager (2.8.0-2.8.3), dendreo (1.1.3-1.1.4), and fastlane-plugin-run_tests_firebase_testlab (0.3.2) from any affected Ruby/Bundler environment; audit Gemfile.lock across all repos for these gems and for slackHtmlToMarkdown, seo_optimizer, and array_fast_methods pulling in git_credential_manager as a dependency
- Treat any workstation that installed or merely `require`d the malicious gem versions as fully compromised, given 2.8.3's auto-execute-on-require behavior
- Remove the dropped daemon and persistence: delete ~/.local/share/gcm/ (binary + .env config), disable and remove the systemd --user unit named git-credential-manager, and remove the matching cron entry
- Inspect /usr/local/sbin/ping6 for an unauthorized setuid (mode 6777) shell and remove it if present; treat its presence as confirmation of successful root privilege escalation
- Block and retroactively hunt for outbound connections to git.disroot.org, particularly HTTPS requests with disabled certificate validation and a bare 'Git' User-Agent, and for the process pattern `ruby .../git_credential_manager-2.8.3/bin/install -> /bin/sh .../deploy.sh`
Workarounds
- Pin Gemfile/Gemfile.lock to known-good, pre-compromise gem versions and disable automatic minor/patch version bumps for third-party gems until re-verified
- Use vendored/local gem caches with `bundle install --local` in CI to avoid unexpectedly pulling newly-published gem versions
Longer-term hardening
- Rotate all credentials reachable from any affected workstation: SSH keys, Git/GitHub/GitLab tokens, cloud provider credentials, package-registry publish tokens, and browser session material
- Audit RubyGems.org (and other registry) account activity for dormant/inactive maintainer accounts on gems your organization depends on; require MFA and gem push OTP/API-key scoping for publishing
- Adopt Software Composition Analysis (SCA) tooling that flags newly-added or first-seen transitive dependencies, especially when a rarely-updated gem suddenly gains a new, unrelated dependency
- Establish a policy of reviewing diffs on version bumps for dormant or rarely-updated third-party gems before allowing them into CI/CD or developer environments
Weaknesses (CWE) in SleeperGem: RubyGems Supply Chain Attack Uses Hijacked
CWE-506, CWE-494, CWE-295, CWE-732, CWE-269
Timeline of SleeperGem: RubyGems Supply Chain Attack Uses Hijacked
- dendreo gem versions 1.1.3/1.1.4 - later hijacked and weaponized - are originally published as legitimate releases.
- fastlane-plugin-run_tests_firebase_testlab v0.3.2 - later hijacked and weaponized - is originally published as a legitimate release; the gem accumulates roughly 574,661 downloads before compromise.
- RubyGems maintainer accounts later hijacked in this campaign go inactive; sources describe them as dormant since 2019 prior to takeover (year-level precision per Wiz Threats).
- git_credential_manager 2.8.1 is published, suppressing Unix console output to reduce the chance a developer notices the dropper running.
- The dormant dendreo gem is republished as versions 1.1.3/1.1.4 with git_credential_manager added as a dependency, propagating the malicious loader to dendreo's existing installed base.
- Using at least two hijacked dormant RubyGems maintainer accounts, attackers publish git_credential_manager 2.8.0, a working dropper that spawns powershell -ExecutionPolicy bypass (Windows) or /bin/sh (Unix) to run a fetched payload.
- Wiz Threats publishes its incident summary for the campaign.
- Aikido Security (researcher Charlie Eriksen) and StepSecurity independently publish technical write-ups identifying and naming the campaign SleeperGem.
- Malicious gem versions are removed (yanked) from RubyGems.org following disclosure.
- fastlane-plugin-run_tests_firebase_testlab (maintainer account pinkroom) and three further dormant gems - slackHtmlToMarkdown, seo_optimizer, and array_fast_methods (maintainer account LR-DEV) - are modified to depend on git_credential_manager, bringing the total to five compromised dependent packages.
- git_credential_manager 2.8.3 is published: the staging safety is removed and the full attack chain auto-executes on a bare require with no explicit install step; this version also establishes systemd/cron persistence and attempts setuid privilege escalation to /usr/local/sbin/ping6.
- git_credential_manager 2.8.2 is published, relocating payload execution into the gem's require() load path, with the execution line still staged/commented out rather than live.
- Corgea publishes an in-depth technical analysis, including process-chain reconstruction, persistence-mechanism details, and defender hunting/detection commands.
- The Hacker News and multiple security outlets (SC Media, secnews.gr, developer-tech.com) publish coverage of the campaign.
- Wiz Threats incident record shows its last update, consistent with ongoing tracking of the campaign as of this research.
Sources cited for SleeperGem: RubyGems Supply Chain Attack Uses Hijacked
- SleeperGem: RubyGems Supply Chain Attack Targets Dormant Maintainer Accounts
- SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts
- SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor
- SleeperGem: hijacked dormant RubyGems accounts turned `require` into a persistent developer backdoor
- SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines
- SleeperGem attack targets Ruby ecosystem with malicious gems
- SleeperGem RubyGems attack evades CI to hit developer laptops
- SleeperGem: Supply Chain Attack via RubyGems
- SleeperGem RubyGems Attack Backdoored Developer Machines via Hijacked Dormant Gems
- RST Cloud - SleeperGem threat report thread
- git-ecosystem/git-credential-manager (legitimate upstream project impersonated by the malicious gem)
Threats related to SleeperGem: RubyGems Supply Chain Attack Uses Hijacked
- SleeperGem Supply-Chain Campaign Uses Three Malicious RubyGems Packages to Backdoor Developer Machines
- SleeperGem: Compromised RubyGems Packages (git_credential_manager, Dendreo, fastlane-plugin-run_tests_firebase_testlab) Drop Persistent Multi-Stage Backdoor via Dormant Maintainer Accounts
- SleeperGem: RubyGems Supply Chain Attack via Compromised Dormant Maintainer Accounts
- OpenClaw / ClawHub AI Skill Marketplace Supply-Chain Compromise — Malicious Skills cluw, AMOS, omnicogg, money-radar, letssendit
Detection coverage for TL-2026-1703
As of 2026-07-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1703 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.