discovered
Brand-new RubyGems dropper impersonating the legitimate Git Credential Manager tool. Four versions published in ~9 hours built up a working binary dropper: it constructs a URL against a hardcoded Forgejo host (git.disroot.org/git-ecosystem/), fetches a payload with SSL certificate verification disabled (OpenSSL::SSL::VERIFY_NONE), and hands it straight to PowerShell (Windows, -ExecutionPolicy bypass) or /bin/sh (Unix). Downloaded binaries were flagged malicious by VirusTotal vendors; final payload not characterized in source. v2.8.2 wired the installer into the gem load path so a plain require triggers it (execution line staged commented-out), and v2.8.3 uncommented it to go live. A skip_install? guard scans ~30 CI-platform environment variables and does nothing when any are present, deliberately sparing CI/build servers to target developer laptops. Aikido labels the incident 'SleeperGem'.