GCVE-110-OSM-2026-8742

Legitimate RubyGem originally published in 2017 whose dormant maintainer account was hijacked as part of the SleeperGem campaign. The attacker reactivated the long-inactive account and added the malicious git_credential_manager gem as a dependency, causing the malicious payload to propagate to all users of Dendreo upon update. === DORMANT ACCOUNT HIJACKING === Original gem published: 2017 Maintainer account inactive: ~6-7 years before compromise Attacker reactivated account and published new version with malicious dependency === DEPENDENCY INJECTION === Malicious dependency added: git_credential_manager Payload delivery: Indirect via dependency chain All users updating Dendreo would pull git_credential_manager and execute its malicious payload