SleeperGem: RubyGems Supply Chain Attack Uses Hijacked Dormant Maintainer Accounts to Weaponize git_credential_manager, Dendreo, and fastlane-plugin-run_tests_firebase_testlab — Threadlinqs Intelligence
As of 2026-07-26, SleeperGem: RubyGems Supply Chain Attack Uses Hijacked Dormant Maintainer Accounts to Weaponize git_credential_manager, Dendreo, and fastlane-plugin-run_tests_firebase_testlab is a high-severity supply chain threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 25 indicators of compromise.
Threat ID: TL-2026-1703 · Severity: HIGH · Status: ACTIVE · Category: SUPPLY_CHAIN
Between July 18-19, 2026, attackers took over at least two RubyGems maintainer accounts dormant since 2019 and published a fake git_credential_manager gem that impersonates Microsoft's official Git
SleeperGem is a RubyGems software-supply-chain campaign, first reported by Wiz Threats and independently analyzed by Aikido Security and StepSecurity, in which attackers compromised long-inactive RubyGems maintainer accounts (dormant since 2019) rather than compromising infrastructure or exploiting a code vulnerability. Using this access, they published a brand-new gem named `git_credential_manager` that impersonates the real, widely-trusted Microsoft Git Credential Manager tool by name alone.
Over a nine-hour window on July 18-19, 2026, the attackers iterated the gem through four published versions, progressively weaponizing it: 2.8.0 was a working dropper that used `Process.spawn` to invoke `powershell -ExecutionPolicy bypass` on Windows or `/bin/sh` on Unix after fetching a payload; 2.8.1 suppressed Unix console output to reduce the chance a developer would notice; 2.8.2 relocated the malicious call into the gem's `require()` load path but left the execution line staged/commented out; and 2.8.3 removed that safety, so the full attack chain now fires automatically the moment any Ruby process merely requires the library, with no explicit `gem install` or invocation needed.
Technically, the loader constructs download URLs of the form `https://git.disroot.org/git-ecosystem/{product}/raw/branch/main` against a public Forgejo (self-hosted Git service) instance, using a deceptive account named `git-ecosystem` to appear ecosystem-adjacent rather than attacker-owned. Before downloading, the code sets `http.verify_mode = OpenSSL::SSL::VERIFY_NONE`, explicitly disabling TLS certificate validation, and spoofs its User-Agent to the bare string "Git". It fetches a `deploy.sh` shell script and a native binary named identically to the impersonated tool. `deploy.sh` copies the binary to `~/.local/share/gcm/git-credential-manager`, makes it executable, drops a config file at `~/.local/share/gcm/.env`, and launches it with a `--daemon` flag - deliberately relocating the payload outside the gem's own install directory so a simple `gem uninstall` does not remove it. Persistence is established redundantly via a systemd `--user` service unit named `git-credential-manager` and a matching cron entry. The malware also probes sudo/wheel group membership; where passwordless sudo is available it re-executes as root and plants a setuid (mode 6777) backdoor shell at `/usr/local/sbin/ping6`.
Before fetching or executing anything, the second stage checks roughly 30 environment variables associated with CI/CD platforms (GitHub Actions, GitLab CI, CircleCI, Travis CI, Jenkins, Vercel) and exits immediately if any are present - a deliberate design choice to avoid detection on short-lived, monitored build infrastructure and instead persist on long-lived developer workstations where secrets (SSH keys, cloud/API tokens, Git credentials, browser session material) accumulate over time.
To spread beyond direct installs of the fake gem, the attackers added `git_credential_manager` as a dependency of five previously-legitimate, long-dormant gems they also controlled: `dendreo` (originally published 2017, republished as 1.1.3/1.1.4), `fastlane-plugin-run_tests_firebase_testlab` (originally published 2018, ~574,661 cumulative downloads, republished as 0.3.2, maintainer account `pinkroom`), and three further packages - `slackHtmlToMarkdown`, `seo_optimizer`, and `array_fast_methods` (maintainer account `LR-DEV`, which controlled four of the five dependent gems). This let the malicious code reach each package's existing downstream users through an ordinary dependency-version bump rather than requiring a direct, conspicuous install of an unfamiliar package.
The malicious releases were yanked from RubyGems.org following disclosure. No CVE, GHSA, or OSV identifier had been assigned as of this research, and no threat actor has been publicly attributed; researchers (notably Aikido's Charlie Eriksen) frame the core innovation as targeting accounts dormant for 6-7 years sp
Weaknesses (CWE)
CWE-506, CWE-494, CWE-295, CWE-732, CWE-269
Target sectors: technology, softwaredevelopment
Target regions: Global
Detections & IOCs
As of 2026-07-27, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 25 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, HIGH, threat intelligence, cybersecurity, T1583.006, T1586, T1195.001, T1059.001, T1059.004, T1543.002, T1053.003, T1548.003, T1548.001, T1036.005