SleeperGem: dormant RubyGems maintainer accounts

What happened

• At least two accounts dormant since 2019 were taken over. The dropper was refined over 4 versions in 9 hours and fires on `require` in 2.8.3.

Sources

• https://threats.wiz.io/all-incidents/sleepergem-rubygems-supply-chain-attack-targets-dormant-maintainer-accounts

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.