SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts

SleeperGem exploited dormant RubyGems maintainer accounts to publish malicious packages, including a fake `git_credential_manager` gem that downloads and executes arbitrary binaries, and compromised at least two unrelated long-abandoned accounts to inject the malware as a dependency into trusted packages like `fastlane-plugin-run_tests_firebase_testlab` (574k downloads). This marks RubyGems' first large-scale supply-chain attack via account takeover, a pattern npm and PyPI have faced for over a year.

This Wire brief sits within Fusion42's coverage of Developer Tools and Cybersecurity. Wire is Fusion42's founder-focused intelligence feed: each story is connected to the funds and startups it names — every one with a live profile on Raise or Scout — so founders can follow the capital and the momentum behind the headline rather than just the headline itself. Wire analysis is one of the live surfaces Arthur reasons over.