On July 18-19, 2026, an attacker compromised at least two dormant RubyGems maintainer accounts (inactive since 2019) to publish malicious gem versions. The attack was discovered when git_credential_manager appeared with suspicious behavior—downloading binaries from a public Forgejo instance at git.disroot[.]org under the deceptive username git-ecosystem. The malware disables SSL verification, executes payloads via PowerShell (Windows) or /bin/sh (Unix), and includes checks for ~30 CI environment variables to deliberately avoid build servers and target developer laptops instead.
The attacker refined the dropper across four versions over 9 hours, culminating in version 2.8.3 where the payload triggers automatically upon require—no explicit installation needed. To maximize reach, the attacker added git_credential_manager as a dependency to the compromised dendreo gem, propagating the malicious payload to existing users.