Security researchers have named a new software supply chain attack SleeperGem after tracing malicious versions of three RubyGems packages back to two separately hijacked maintainer accounts. The most notable of the three, git_credential_manager, impersonates Microsoft’s genuine Git Credential Manager tool. The other two, Dendreo and fastlane-plugin-run_tests_firebase_testlab, were both long-dormant packages, one untouched since 2020 and the other since 2019, before new versions appeared within hours of each other in mid-July 2026. Because git_credential_manager was added as a dependency of the other two packages, installing either one was enough to pull in the malicious payload without a developer ever installing it directly.
A payload designed to wait for the right target
The technically interesting part of SleeperGem is not the initial compromise, account takeovers of dormant maintainer accounts are a familiar pattern by now, but what the payload does once it lands. Each malicious release acts as a loader that fetches a second-stage payload from an attacker-controlled host. Before doing anything further, it checks roughly 30 environment variables associated with common CI platforms, including GitHub Actions, GitLab, CircleCI, Travis and Jenkins. If it detects any of them, it exits immediately and does nothing. Only on what it determines to be a genuine developer workstation does it drop a native persistence daemon and set up long-term access.
That evasion logic is a deliberate design decision, and a smart one from an attacker’s perspective. Most organisations’ supply chain defences, dependency scanning, SBOM checks, package allow-lists, are concentrated at the CI/CD layer, where builds are ephemeral and easy to instrument. A payload built to recognise and skip that exact environment routes around a large share of the tooling teams have invested in, and lands instead on the machine with the most persistent access: the developer’s own laptop, complete with SSH keys, cloud credentials, saved sessions and whatever else accumulates on a machine used every day for months or years.
What to check if your team uses these packages, or Ruby tooling generally
Any team that has installed git_credential_manager, Dendreo or fastlane-plugin-run_tests_firebase_testlab in the affected version ranges should treat the machine and every credential accessible from it as compromised, not just remove the package. That means rotating SSH keys, cloud and Git credentials, and checking for the dropped daemon and any persistence mechanisms it installed, rather than assuming a gem uninstall closes the door.
More broadly, this incident is a good prompt to check whether your organisation’s dependency security actually extends past the CI pipeline. If your scanning, monitoring and credential hygiene are all built around what happens in the build server, and your developer laptops are running whatever local Ruby, Node or Python environment each engineer happens to have installed, SleeperGem-style attacks are specifically designed to exploit that gap.
If you want an honest assessment of where your software supply chain defences actually stop, and what it would take to extend real protection to developer endpoints rather than just CI runners, contact Excello Digital. We help European engineering teams close the gap between what their tooling checks and what their attackers actually target.