GCVE-110-OSM-2026-8741

Legitimate Fastlane plugin with 574,661 total downloads whose dormant maintainer account was hijacked as part of the SleeperGem campaign. A different compromised account from the Dendreo gem was used, indicating the attacker had access to multiple dormant RubyGems accounts. The attacker added the malicious git_credential_manager gem as a dependency to propagate the backdoor to the plugin's large install base. === DORMANT ACCOUNT HIJACKING === Total gem downloads: 574,661 Different maintainer account compromised than Dendreo Both accounts were long-dormant and reactivated within hours of each other === DEPENDENCY INJECTION === Malicious dependency added: git_credential_manager Payload delivery: Indirect via dependency chain High-impact target due to large download count and Fastlane/mobile CI usage