GCVE-110-OSM-2026-8743

Primary dropper gem in the SleeperGem supply chain attack. Published in rapid succession across versions 2.8.0 through 2.8.3 over ~9 hours, each version adding increasingly sophisticated malicious capabilities. Downloads and executes platform-specific binaries from a Forgejo instance (git.disroot.org/git-ecosystem), disables SSL verification, detects and avoids CI/CD environments by checking ~30 environment variables, and targets developer laptops specifically. === STAGED DELIVERY (versions 2.8.0 - 2.8.3) === Malicious payload wired into gem load path for automatic execution on require === C2 INFRASTRUCTURE === C2 URL pattern: https://git.disroot.org/git-ecosystem/{product}/raw/branch/main Attacker Forgejo username: git-ecosystem SSL verification explicitly disabled: OpenSSL::SSL::VERIFY_NONE === EXECUTION METHODS === Windows: powershell -ExecutionPolicy bypass Unix: /bin/sh Output redirected to /dev/null (v2.8.1+) === CI/CD EVASION === Checks ~30 environment variables from: GitHub Actions, GitLab CI, CircleCI, Travis CI, Jenkins, Vercel Skips execution in CI environments, targets developer workstations only === SUPPLY CHAIN WIDENING === Injected as dependency into compromised legitimate gems (Dendreo, fastlane-plugin-run_tests_firebase_testlab) to spread to existing users