Loading story…
A coordinated RubyGems supply-chain attack dubbed SleeperGem used malicious releases of git_credential_manager, Dendreo, and fastlane-plugin-run_tests_firebase_testlab to target developer workstations. Researchers reported that the attacker appears to have hijacked long-dormant maintainer accounts and pushed trojanized gem versions, including git_credential_manager 2.8.0 through 2.8.3, with code that executed on library load, fetched additional payloads from a fake-looking Git ecosystem repository on git.disroot.org, and deliberately avoided running in CI environments to reduce detection.
On developer machines, the gems reportedly acted as loaders for a second stage that installed a native daemon, established persistence through systemd and cron, and attempted privilege escalation via passwordless sudo to place a setuid root shell at /usr/local/sbin/ping6. Investigators said the malicious releases did not match legitimate source tags and that some affected packages had been inactive for years before suddenly publishing updates, indicating account compromise rather than normal maintenance. Security firms warned that any system that installed or required the affected gems should be treated as fully compromised and that all accessible credentials and secrets should be rotated.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
On July 19, 2026, Aikido and StepSecurity published analyses identifying the SleeperGem campaign and detailing how the malicious gems fetched second-stage payloads from git.disroot.org while avoiding CI environments. StepSecurity reported that the payload established persistence via systemd and cron and attempted privilege escalation by installing a setuid root shell at /usr/local/sbin/ping6.
Between July 18 and July 19, 2026, attackers published malicious versions of the RubyGems packages git_credential_manager, Dendreo, and fastlane-plugin-run_tests_firebase_testlab. The activity was described as a coordinated supply-chain attack involving dormant or compromised maintainer accounts and malicious updates that did not match legitimate source tags.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcethehackernews.com
Open sourceaikido.dev
Open sourcestepsecurity.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A malicious npm campaign used the account **`gemini-check`** to publish trojanized packages including **`gemini-ai-checker`**, **`express-flowlimit`**, and **`chai-extensions-extras`**, disguising them as legitimate developer utilities while delivering a staged JavaScript payload from Vercel-hosted infrastructure. Researchers linked the malware to **OtterCookie**, a modular Node.js backdoor associated with the DPRK-linked **Contagious Interview** activity cluster, citing overlaps in payload design, remote access capability, and data-theft behavior. The packages were downloaded more than 500 times in total, and while **`gemini-ai-checker`** was removed, the other packages were still available at the time of reporting. The malware executed code in memory to reduce detection and then stole browser credentials, cryptocurrency wallets, files, clipboard contents, and developer secrets. It also explicitly targeted directories tied to AI coding tools including **Cursor**, **Claude**, **Gemini CLI**, **Windsurf**, **PearAI**, and **Eigent**, enabling theft of API tokens, conversation logs, source code, SSH keys, and cloud credentials. The campaign shows a software supply-chain intrusion aimed directly at developers, with a particular focus on compromising AI-assisted development environments and the sensitive access they contain.
Jun 29, 2026
Researchers reported that the **Mini Shai-Hulud** campaign compromised widely used developer packages across **npm, PyPI, and Packagist/Composer**, including SAP CAP components, `intercom-client`, `intercom/intercom-php`, and PyTorch Lightning’s `lightning` package. The malicious releases delivered an obfuscated credential stealer executed with the **Bun** runtime, harvesting secrets from developer workstations and CI/CD environments, including GitHub, npm, cloud, Kubernetes, and AI tooling credentials. Stolen data was encrypted and exfiltrated through attacker-created public GitHub repositories, and the campaign was linked by multiple researchers to **TeamPCP**. Reports estimated exposure ranging from more than **1,000** to roughly **1,800 repositories**, with no `CVE`, `GHSA`, or `OSV` identifiers assigned at disclosure. Investigators said the attackers abused software publishing workflows rather than relying solely on direct maintainer compromise, including a stolen npm token tied to SAP’s `cloudmtabot` account, an exposed token in CircleCI pull-request builds, and overly broad GitHub and npm **OIDC trusted publishing** policies. The malware propagated by using stolen npm tokens to publish infected patch versions of additional packages and established persistence through developer tooling by planting `.vscode/tasks.json` entries with `"runOn": "folderOpen"` and `.claude/settings.json` `SessionStart` hooks, a technique compared to the earlier **PolinRider/TasksJacker** tradecraft. Maintainers released cleaned package versions, while defenders were urged to rotate credentials, review GitHub, npm, and cloud activity, harden OIDC publishing rules, pin dependencies, and hunt repositories for unauthorized `folderOpen` tasks and Claude hooks.
Jun 29, 2026
Researchers disclosed a large-scale automated supply chain attack dubbed **Megalodon** that pushed **5,718 malicious commits** into **5,561 GitHub repositories** in less than six hours, using forged CI/CD bot identities and benign-looking commit messages to slip in malicious GitHub Actions workflow files. The workflows requested elevated permissions and carried base64-encoded bash payloads that executed after maintainers merged the changes, harvesting CI/CD environment data, cloud credentials, SSH keys, Docker and Kubernetes secrets, Vault and Terraform credentials, GitHub OIDC tokens, and other source-code and developer secrets. Investigators said the stolen data was exfiltrated over HTTP POST requests to **`216.126.225[.]129:8443`**, with two workflow variants observed, including payloads labeled **SysDiag** and **Optimize-Build**. The most visible downstream impact was a compromise of the **Tiledesk** repository, where a malicious workflow change led to the publication of poisoned **`@tiledesk/tiledesk-server`** npm versions **`2.18.6`** through **`2.18.12`**. Reporting tied the activity to a broader pattern of software supply chain abuse associated with **TeamPCP**, whose earlier incidents affected major open-source and commercial projects and prompted npm to invalidate some write-capable granular access tokens that could bypass 2FA protections. Security firms urged organizations to review repositories for unauthorized workflow changes, block the identified command-and-control infrastructure, rotate exposed secrets and keys, and inspect cloud and CI logs for signs of credential theft or cloud impersonation.
Jun 29, 2026