Security researchers at Aikido have disclosed SleeperGem, a RubyGems supply-chain attack that hijacked three long-dormant maintainer accounts to publish trojanized gem versions between July 18 and July 19, 2026. The campaign’s defining trait is its target selection: the payload actively fingerprints its execution environment and refuses to run on CI infrastructure, waiting instead for a developer’s own machine.

What Happened

The attackers took over accounts behind three RubyGems packages: git_credential_manager, which impersonates Microsoft’s official Git Credential Manager tooling; Dendreo, untouched since October 2020; and fastlane-plugin-run_tests_firebase_testlab, inactive since March 2019 and carrying over 574,000 historical downloads. As Aikido researcher Charlie Eriksen put it, “a RubyGems account that has gone quiet for six or seven years doesn’t look risky to anyone” — which is precisely why the technique works. None of the original maintainers appear to have been targeted directly through credential phishing reports so far; the accounts were simply reactivated and used to push new releases after years of silence.

For git_credential_manager, version 2.8.2 shipped with the line that executes the downloaded second-stage script commented out — likely a staging or test build. Version 2.8.3, published shortly after, removed that safeguard and runs the full infection chain. Dendreo shipped versions 1.1.3 and 1.1.4, and the fastlane plugin shipped 0.3.2, none of which have any legitimate upstream basis.

Technical Details

Each malicious release acts as a loader: on install it reaches out to an attacker-controlled Forgejo instance to fetch a second-stage payload. Before executing anything further, the loader checks the environment for roughly 30 environment variables associated with CI/CD platforms — GitHub Actions, GitLab CI, CircleCI, Travis CI, and Vercel among them. If any are present, the loader exits immediately, a deliberate evasion of the ephemeral, heavily-monitored build runners that most software supply-chain detection tooling is tuned to watch.

On an unflagged (developer) host, the install script copies the fetched binary into a hidden directory under the user’s home folder, marks it executable, and launches it as a background native daemon. Persistence is installed twice for redundancy — once as a systemd user service and once as a cron entry — so removing either one alone leaves the malware running. No CVE has been assigned, since this is an account-takeover and malicious-publish incident rather than a software defect.

Impact

This shifts the usual npm/PyPI supply-chain playbook — CI-token theft and secrets exfiltration from build systems — onto individual developer workstations, where security tooling is typically thinner and SSH keys, cloud credentials, and personal access tokens live in plaintext config files. Any organization or individual that installed git_credential_manager, Dendreo, or fastlane-plugin-run_tests_firebase_testlab (particularly the flagged versions above) since July 18 should treat the host as compromised. The reuse of long-abandoned but still-trusted package names means dependency scanners keyed only on “recently published” or “low download count” heuristics will miss this class of attack entirely.

Mitigation

  • Search installed gems and Gemfile.lock/Gemfile.lock.diff history for git_credential_manager, dendreo, and fastlane-plugin-run_tests_firebase_testlab; remove any matching the flagged versions immediately.
  • On any host that installed these gems, treat it as compromised: check for a hidden binary and daemon process, remove both the systemd user service and the cron persistence entry, and rotate SSH keys, cloud credentials, and any tokens stored on that machine.
  • Block or alert on outbound traffic to unfamiliar Forgejo instances from developer endpoints — self-hosted Git forges are an increasingly common low-reputation C2 channel that bypasses domain-reputation blocklists tuned for GitHub/GitLab.
  • Treat “dormant maintainer, sudden release after years of silence” as a first-class supply-chain risk signal in dependency review, not just low-download or newly-published packages.
  • Enforce 2FA and session/API-key rotation policies on package-registry maintainer accounts, especially ones that haven’t published in years but still own widely-depended-upon package names.

Sources