Full Report
On July 18-19, 2026, an attacker compromised at least two dormant RubyGems maintainer accounts (inactive since 2019) to publish malicious gem versions. The attack was discovered when git_credential_manager appeared with suspicious behavior—downloading binaries from a public Fo...
Analysis Summary
# Incident Report: SleeperGem Supply Chain Attack
## Executive Summary
On July 18-19, 2026, an unknown actor compromised dormant RubyGems maintainer accounts to execute a sophisticated supply chain attack. By injecting a malicious dependency into established gems, the attacker distributed a multi-platform dropper designed to target developer workstations while specifically evading CI/CD environments. The incident highlights the persistent risk of "sleeper" accounts in package registries and the evolving precision of supply chain targeting.
## Incident Details
- **Discovery Date:** July 19, 2026
- **Incident Date:** July 18–19, 2026
- **Affected Organization:** RubyGems Registry / Users of affected gems (`dendreo`, `git_credential_manager`)
- **Sector:** Software Development / Technology
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** July 18, 2026
- **Vector:** Account Takeover (ATO)
- **Details:** The attacker gained unauthorized access to at least two RubyGems maintainer accounts that had been inactive since 2019.
### Lateral Movement
- **Movement:** The attacker utilized the compromised permissions to publish a malicious package named `git_credential_manager`. They then added this package as a mandatory dependency to the legitimate `dendreo` gem, ensuring infected updates reached the `dendreo` user base.
### Data Exfiltration/Impact
- **Impact:** The malicious code executes payloads via PowerShell (Windows) or `/bin/sh` (Unix). It circumvents security by disabling SSL verification. The primary impact is the potential for full system compromise of developer laptops.
### Detection & Response
- **Discovery:** Analysis of suspicious behavior in the `git_credential_manager` gem, which was observed downloading binaries from an external source.
- **Response:** Forensic analysis revealed the attacker iterated through four versions of the dropper over 9 hours, perfecting the evasion and execution triggers.
## Attack Methodology
- **Initial Access:** Compromise of dormant maintainer credentials.
- **Persistence:** Published malicious gem versions that remain in the registry until revoked; established a dependency chain to ensure re-infection or wide distribution.
- **Privilege Escalation:** Not applicable (used existing maintainer privileges).
- **Defense Evasion:**
- Used a deceptive username (`git-ecosystem`) on a public Forgejo instance.
- Disables SSL verification.
- **Anti-Analysis:** Includes checks for ~30 environment variables to detect CI/CD build servers and abort execution to avoid detection by automated scanners.
- **Credential Access:** Likely credential stuffing or reuse targeting inactive accounts.
- **Discovery:** Targeted developer laptops by filtering out CI environments.
- **Lateral Movement:** Used `dendreo` gem as a secondary distribution vector.
- **Collection:** N/A (Focus was on execution and command/control).
- **Exfiltration:** N/A in provided context.
- **Impact:** Supply chain compromise; unauthorized code execution on developer machines.
## Impact Assessment
- **Financial:** Unknown; potential costs associated with remediation and incident response for affected downstream organizations.
- **Data Breach:** High risk of source code or local secret theft from compromised developer environments.
- **Operational:** Disruption to RubyGems ecosystem trust; necessitated manual auditing of dependencies.
- **Reputational:** Significant impact on the perceived security of dormant accounts within the RubyGems registry.
## Indicators of Compromise
- **Network indicators:**
- hxxps://git.disroot[.]org/git-ecosystem/ (Source of malicious binaries)
- **File indicators:**
- `git_credential_manager` (Versions 2.8.0 through 2.8.3)
- `dendreo` (Version containing the malicious dependency)
- **Behavioral indicators:**
- Unauthorized PowerShell or `/bin/sh` execution triggered by Ruby `require` statements.
- Outbound connections to `git.disroot[.]org` for binary downloads.
## Response Actions
- **Containment:** Identification and flagging of the malicious `git_credential_manager` versions.
- **Eradication:** Removal of malicious versions from the RubyGems registry.
- **Recovery:** Restoration of maintainer account control and notification of the community.
## Lessons Learned
- **Key Takeaways:** Inactive accounts with "Write" permissions are high-value targets for supply chain actors.
- **Evasion Tactics:** Attackers are becoming highly selective, intentionally avoiding CI/CD environments to stay under the radar of automated security tools.
- **Execution Triggers:** The shift to triggering payloads via `require` (rather than just installation) increases the success rate of the attack.
## Recommendations
- **Registry Security:** Implement mandatory Multi-Factor Authentication (MFA) for all RubyGems maintainers, regardless of activity level.
- **Account Governance:** Implement policies to automatically revoke publishing permissions for accounts inactive for more than a specific duration (e.g., 1 year).
- **Developer Security:** Use dependency locking (e.g., `Gemfile.lock`) and perform integrity checksum validations.
- **Monitoring:** Implement endpoint detection and response (EDR) on developer laptops to flag suspicious shell executions or unorthodox outbound network traffic from package managers.