Dormant RubyGems accounts woke up to publish a backdoor

Between July 18 and 19, 2026, malicious versions of two long-dormant Ruby gems appeared on RubyGems.org, published from maintainer accounts that had been quiet for years. Researchers named the campaign SleeperGem.

The tell was the publishing history. Dendreo, a gem whose public release line had stopped at 1.1.2 in 2020, gained versions 1.1.3 and 1.1.4 on July 18. fastlane-plugin-run_tests_firebase_testlab, untouched since 2019, gained 0.3.2 on July 19. The two gems belong to different maintainers, LR-DEV and pinkroom, which points to at least two compromised accounts rather than one. A third gem in the campaign, git_credential_manager, was newly created to impersonate Microsoft's Git Credential Manager, and is not treated here as a compromised project.

The stage-one Ruby code disabled TLS certificate verification with OpenSSL::SSL::VERIFY_NONE and fetched a second stage from an attacker-controlled Forgejo instance at git.disroot.org, then spawned /bin/sh or PowerShell. Before doing any of that it looked around. The loader checked roughly thirty CI-related environment variables and exited if it believed it was running inside GitHub Actions, GitLab CI, CircleCI, Jenkins, Travis, or Vercel. That is the inversion worth noting: most 2026 npm and PyPI worms went hunting for build runners because that is where the cloud credentials live. SleeperGem deliberately avoided them, presumably because build systems are monitored and laptops are not.

On a developer machine it dropped a native daemon into ~/.local/share/gcm/ and installed redundant persistence through both a systemd --user unit and cron, with an attempted privilege escalation by way of /usr/local/sbin/ping6. The operators iterated visibly across the four git_credential_manager releases over about nine hours, moving execution into the require() path in 2.8.2 with the final script commented out, then re-enabling it in 2.8.3, which the rubygems-security-team yanked.