SleeperGem gem install process spawns deploy.sh via shell or PowerShell

Duo Tech@duotech

•updated Jul 27, 2026•0•0•3

Detects suspicious execution patterns associated with the SleeperGem supply chain attack, where a compromised Gem install script (git_credential_manager-2.8.3/bin/install) spawns shell or PowerShell commands to trigger secondary malicious scripts like deploy.sh or redirects output to /dev/null.