SleeperGem: RubyGems supply chain attack targets dormant maintainer accounts

A malicious RubyGem named git_credential_manager was published and iteratively developed over hours to act as a dropper: it fetched binaries from a Forgejo host (disabling SSL verification), executed them via shell/PowerShell, and was later wired to run on mere require() calls. The attacker added this gem as a dependency to other packages and appears to have compromised multiple maintainer accounts, including an unrelated fastlane plugin with 574,661 downloads, suggesting a targeted supply-chain campaign aimed at developer machines rather than CI runners.