# SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts

Malicious RubyGems package git_credential_manager dropped binaries from a fake Forgejo host on require, spread via hijacked dormant maintainer accounts and dependency injection.

- Payout: Real-world hack
- Severity: high
- Program: RubyGems
- Analysis by: Aikido Security
- Disclosed: 2026-07-19
- Write-up quality: 6/10
- Original: https://www.aikido.dev/blog/sleepergem-rubygems-supply-chain-attack
- Library page: https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-sleepergem-rubygems-supply-chain-attack
- Tags: area:oss domain:oss impact:integrity impact:mass-exploit impact:rce kind:incident platform:threat-intel sev:high tech:ruby technique:source-review vuln:dependency-confusion vuln:rce

**Target:** RubyGems package (git_credential_manager) and dependent gems
**Root cause:** Attacker took over dormant maintainer accounts and published a gem whose load path executes a dropper that fetches binaries from an attacker-controlled Forgejo repo with TLS verification disabled.
**Steps:**
1. Observe new gem `git_credential_manager` with four rapid versions
2. Inspect code: `base_url` builds `https://git.disroot.org/git-ecosystem/#{product}/raw/branch/main`
3. Note `http.verify_mode = OpenSSL::SSL::VERIFY_NONE`
4. Payload executed via `Process.spawn("powershell -ExecutionPolicy bypass ...")` on Windows or `/bin/sh` on Unix
5. v2.8.2 wires installer into gem load path so `require 'git_credential_manager'` triggers it
6. `skip_install?` checks ~30 CI env vars (GitHub Actions, GitLab CI, CircleCI, Travis, Jenkins, Vercel) to avoid build servers
7. Compromised gems Dendreo and fastlane-plugin-run_tests_firebase_testlab add git_credential_manager as dependency
**How found:** Triage queue flagged a brand-new gem with four versions published in rapid succession; code review revealed hardcoded Forgejo host, disabled TLS verification, and shell spawn.
**Exploitation:** Developer installs or requires the gem on a laptop; the gem downloads and executes attacker binaries from git.disroot.org with TLS verification disabled, giving code execution. Dependency injection into Dendreo and fastlane plugin spreads payload to existing users.
**Escalation:** Chained across two unrelated dormant maintainer accounts and injected as a dependency into other trusted gems to widen distribution.
**Insight:** Dormant maintainer accounts (5-7 years idle) are prime takeover targets; also watch for gems that skip execution when CI env vars are present, a strong signal of laptop-targeting malware.