--- title: SleeperGem: RubyGems supply chain attack targets dormant... description: Two dormant RubyGems maintainer accounts were hijacked to push malicious packages in what appears to be RubyGems' first coordinated supply chain attack of this... canonical: https://daily.dev/posts/sleepergem-rubygems-supply-chain-attack-targets-dormant-maintainer-accounts-q90puc15p twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts | daily.dev og:description: Two dormant RubyGems maintainer accounts were hijacked to push malicious packages in what appears to be RubyGems' first coordinated supply chain attack of this... og:url: https://daily.dev/posts/sleepergem-rubygems-supply-chain-attack-targets-dormant-maintainer-accounts-q90puc15p og:image: https://api.daily.dev/og/posts/q90PuC15P.png og:image:alt: SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts **[Aikido Security](https://daily.dev/sources/aikido-security)** · 4 min read · 2 upvotes · 0 comments ## Summary Two dormant RubyGems maintainer accounts were hijacked to push malicious packages in what appears to be RubyGems' first coordinated supply chain attack of this kind. A new gem called `git_credential_manager` was published in four rapid versions, evolving from a basic binary dropper to a stealthy payload that executes on mere `require` — while deliberately skipping CI environments to target developer laptops. The attacker also injected the malicious gem as a dependency into other trusted gems, including `fastlane-plugin-run_tests_firebase_testlab` with over 574,000 downloads, compromising at least two unrelated maintainer accounts. The attack exploits the low-risk profile of long-dormant accounts — the 'SleeperGem' pattern — which had previously been more common on npm and PyPI. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the SleeperGem RubyGems supply chain attack and how does it work? SleeperGem refers to an attack where two long-dormant RubyGems maintainer accounts, inactive for six to seven years, were hijacked to publish malicious gems. The malicious git_credential_manager gem was built across four rapid versions that fetched binaries from a fake Forgejo repository and ran them via shell or PowerShell, triggered simply by requiring the library, while skipping CI environments to target developer laptops. _Teams tracking dependency risk can follow emerging supply chain attacks like this one on daily.dev._ ### Which RubyGems packages were compromised in the SleeperGem attack? The compromised packages include git_credential_manager, a brand-new malicious gem; Dendreo, an existing gem first published in 2017 that had the malicious dependency added; and fastlane-plugin-run_tests_firebase_testlab, a gem with 574,661 total downloads maintained by a completely different account, suggesting the compromise spread across multiple unrelated maintainers. _Developers auditing their dependency tree can watch for similar compromised-package disclosures via daily.dev._ ### How did the malicious git_credential_manager RubyGems package avoid detection on CI servers? It included a skip_install check that scanned for roughly 30 environment variables belonging to CI platforms such as GitHub Actions, GitLab CI, CircleCI, Travis, Jenkins, and Vercel, and did nothing if any were detected. This let the malware avoid disposable build servers and specifically target developer laptops instead, where the malicious payload could persist longer. _Security-conscious teams hardening CI pipelines against supply chain threats can track incidents like this on daily.dev._ ## Similar posts on daily.dev - [The Hidden Dangers in Your Gemfile: Supply Chain Attacks in RubyGems - FastRuby.io](https://daily.dev/posts/the-hidden-dangers-in-your-gemfile-supply-chain-attacks-in-rubygems---fastruby-io-rtyemnyzl) · RUBYLAND · 0 upvotes · 0 comments - [199 RubyGems, two techniques, zero working payloads: Inside a cryptomining campaign that never ran](https://daily.dev/posts/199-rubygems-two-techniques-zero-working-payloads-inside-a-cryptomining-campaign-that-never-ran-klqjdu1va) · Security Boulevard · 0 upvotes · 0 comments - [GemStuffer Campaign Abuses RubyGems as Exfiltration Channel ...](https://daily.dev/posts/gemstuffer-campaign-abuses-rubygems-as-exfiltration-channel--a8nbznkit) · Socket · 1 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#malware](https://daily.dev/tags/malware), [#ruby](https://daily.dev/tags/ruby) [View this post on daily.dev](https://daily.dev/posts/sleepergem-rubygems-supply-chain-attack-targets-dormant-maintainer-accounts-q90puc15p) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts","url":"https://daily.dev/posts/sleepergem-rubygems-supply-chain-attack-targets-dormant-maintainer-accounts-q90puc15p","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/sleepergem-rubygems-supply-chain-attack-targets-dormant-maintainer-accounts-q90puc15p"},"datePublished":"2026-07-19T08:45:32.066Z","dateModified":"2026-09-14T09:05:05.803Z","description":"Two dormant RubyGems maintainer accounts were hijacked to push malicious packages in what appears to be RubyGems' first coordinated supply chain attack of this...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/81438e4a6e90ff192b5cbba96e98030d?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/81438e4a6e90ff192b5cbba96e98030d?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Aikido Security","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Aikido Security","logo":"https://media.daily.dev/image/upload/s--vJDqDYv_--/f_auto,q_auto/v1774959928/logos/aikido-security?_a=BAMAMiWQ0","url":"https://daily.dev/sources/aikido-security"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/sleepergem-rubygems-supply-chain-attack-targets-dormant-maintainer-accounts-q90puc15p","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,malware,ruby","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Aikido Security","item":"https://daily.dev/sources/aikido-security"},{"@type":"ListItem","position":3,"name":"SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/sleepergem-rubygems-supply-chain-attack-targets-dormant-maintainer-accounts-q90puc15p#faq","mainEntity":[{"@type":"Question","name":"What is the SleeperGem RubyGems supply chain attack and how does it work?","acceptedAnswer":{"@type":"Answer","text":"SleeperGem refers to an attack where two long-dormant RubyGems maintainer accounts, inactive for six to seven years, were hijacked to publish malicious gems. The malicious git_credential_manager gem was built across four rapid versions that fetched binaries from a fake Forgejo repository and ran them via shell or PowerShell, triggered simply by requiring the library, while skipping CI environments to target developer laptops. Teams tracking dependency risk can follow emerging supply chain attacks like this one on daily.dev."}},{"@type":"Question","name":"Which RubyGems packages were compromised in the SleeperGem attack?","acceptedAnswer":{"@type":"Answer","text":"The compromised packages include git_credential_manager, a brand-new malicious gem; Dendreo, an existing gem first published in 2017 that had the malicious dependency added; and fastlane-plugin-run_tests_firebase_testlab, a gem with 574,661 total downloads maintained by a completely different account, suggesting the compromise spread across multiple unrelated maintainers. Developers auditing their dependency tree can watch for similar compromised-package disclosures via daily.dev."}},{"@type":"Question","name":"How did the malicious git_credential_manager RubyGems package avoid detection on CI servers?","acceptedAnswer":{"@type":"Answer","text":"It included a skip_install check that scanned for roughly 30 environment variables belonging to CI platforms such as GitHub Actions, GitLab CI, CircleCI, Travis, Jenkins, and Vercel, and did nothing if any were detected. This let the malware avoid disposable build servers and specifically target developer laptops instead, where the malicious payload could persist longer. Security-conscious teams hardening CI pipelines against supply chain threats can track incidents like this on daily.dev."}}]} ```