SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts

SleeperGem exploited dormant RubyGems maintainer accounts to publish malicious packages, including a fake `git_credential_manager` gem that downloads and executes arbitrary binaries, and compromised at least two unrelated long-abandoned accounts to inject the malware as a dependency into trusted packages like `fastlane-plugin-run_tests_firebase_testlab` (574k downloads). This marks RubyGems' first large-scale supply-chain attack via account takeover, a pattern npm and PyPI have faced for over a year.

This Wire brief sits within Fusion42's coverage of Developer Tools and Cybersecurity.