Poisoned Pipeline / Incidents / AS68
SleeperGem (git_credential_manager, Dendreo, fastlane plugin)
On 18–19 July 2026 malicious versions of git_credential_manager
(impersonating Microsoft Git Credential Manager), Dendreo, and
fastlane-plugin-run_tests_firebase_testlab shipped on RubyGems with no
matching git tags. Two gems had been dormant for years. Each is a
loader: skip if CI env vars are set, otherwise fetch deploy.sh and a
native daemon from a Forgejo host (git.disroot.org), persist via systemd
user service and cron, and probe passwordless sudo for a setuid shell.
Named by Aikido; StepSecurity detonated under Harden-Runner.
Mapped techniques
- T0136 Brandjacking
- T0121 Compromised legitimate artifact
- T0109 Publish malicious artifact
- T0159 Malicious artifact execution
- T0172 Runtime backdoor
supply-chain dormant rubygems loaders
git_credential_manager impersonates Microsoft Git Credential Manager.
Dendreo and fastlane plugin versions with no source tags.
Coordinated RubyGems publishes 18–19 July 2026.
Runs on require, not only install; skips CI.
Native daemon plus systemd/cron persistence.