🕵️ SleeperGem

The items that name it 4

• The State of Open Source Supply Chain Attacks
  article2026-08-23

  Backdoored git_credential_manager and fastlane RubyGems.

• Anthropic Incident: An AI Agent Published a Malicious Package to PyPI and 15 Real Systems Ran It
  article2026-08-03

  Referenced as a prior StepSecurity malicious-package write-up showing a full kill chain captured by Harden-Runner; no further detail given on this page.

• SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor
  writeup2026-07-19

  Coordinated RubyGems supply chain attack that published malicious versions of git_credential_manager, Dendreo, and fastlane-plugin-run_tests_firebase_testlab between July 18 and July 19, 2026, dropping a persistent backdoor on developer machines; named and first reported by the research team at Aiki

• SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts
  writeup2026-07-19

  Name coined by Aikido for the campaign/technique of hijacking dormant RubyGems maintainer accounts (accounts dormant six or seven years) to publish malicious gem versions; two accounts compromised so far.