🧰 git_credential_manager

The items that name it 4

• @7nohe/openapi-react-query-codegen Compromised Through an Exposed npm Publishing Workflow
  writeupas tools2026-08-28It is written here as git credential-manager.

  Legitimate credential manager invoked by the malicious payload ('git credential-manager github list --no-ui') to enumerate stored GitHub credentials

• The State of Open Source Supply Chain Attacks
  articleas affected products2026-08-23It is written here as git_credential_manager (RubyGems).

  Backdoored by SleeperGem.

• SleeperGem: Compromised git_credential_manager, Dendreo, and fastlane RubyGems Drop a Persistent Backdoor
  writeupas affected products2026-07-19It is written here as git_credential_manager (RubyGem).

  Malicious gem impersonating the official Microsoft Git Credential Manager; on require (2.8.2+) spawns a loader that downloads deploy.sh and a native daemon binary. Version 2.8.2 stages the payload (launch line commented out); version 2.8.3 removes that safety and runs the full attack chain.

• SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts
  writeupas affected products2026-07-19

  Brand-new malicious gem with four versions (2.8.0, 2.8.1, 2.8.2, 2.8.3) published in rapid succession, acting as a dropper for malware.