CVE
CVE-2026-48815
CWE
CWE-506, CWE-494, CWE-295, CWE-347, CWE-200, CWE-829
Affected Surface
- RubyGems, Bundler, and Fastlane users who installed or loaded `git_credential_manager` 2.8.0-2.8.3, `Dendreo` 1.1.3-1.1.4, or `fastlane-plugin-run_tests_firebase_testlab` 0.3.2 on developer workstations
- Windows hosts that installed and executed the malicious NuGet DotnetTool packages tied to the `pepesoft.exe` downloader and Google-Sheets-backed surveillance control plane
- Node.js build, release, admission, or artifact-validation paths that relied on `sigstore <= 4.1.0` with `certificateOIDs` to narrow signer trust policy
Welcome to Corgea’s weekly briefing. The briefing covers the most important security findings and research from the week.
This edition covers research published from Wednesday, 15 July through Tuesday, 21 July 2026, excluding items already covered in the 14 July briefing.
Top Article
SleeperGem: hijacked dormant RubyGems accounts turned require into a persistent developer backdoor
This week’s most important story is SleeperGem, because it combines dormant maintainer-account hijack, trusted transitive fan-out, and a require()-time backdoor that persists on developer machines. Aikido deserves first public-disclosure credit for mapping the dormant-account compromise and version-by-version loader evolution, while StepSecurity deserves runtime-analysis credit for proving that the later chain pivoted into normal library-load execution, skipped many CI environments, and planted persistence under ~/.local/share/gcm/. That combination makes SleeperGem the clearest follow-on to the AsyncAPI compromise, the jscrambler import-time infostealer, and the Rollup polyfill RAT chain: the trusted boundary is no longer package installation, but ordinary library load inside a developer workflow.
The key thing to remember is that the attacker did not stop at a fresh fake gem. They hijacked dormant maintainer trust, republished legacy packages to fan the malicious dependency into existing Bundler graphs, and then biased the payload toward developer workstations instead of CI. That transitive fan-out is why subscribers should read SleeperGem alongside PolinRider’s cross-ecosystem spread, the Braintree.Net production skimmer, and this week’s Pepesoft NuGet surveillance campaign: attackers keep winning by hiding execution inside tools and dependencies teams already treat as normal project plumbing.
More news
11 malicious NuGet tools disguised as game cheats stage pepesoft.exe and spreadsheet-backed host surveillance
This deserves close attention because it turns the “it’s only a developer tool” excuse into a full host-compromise story. Socket deserves first public-disclosure and reverse-engineering credit for clustering the eleven malicious DotnetTool packages, the shared pepesoft.exe loader, and the Google-Sheets-backed control plane, while CyberPress and CybersecurityNews deserve credit for broadening public awareness of the campaign. In practical terms, this belongs beside Braintree.Net’s live-card skimmer, the Paysafe, Skrill, and Neteller typosquat wave, and the TeamPCP playbook: attackers are abusing package-delivered helper tools as direct workstation and credential access.
What matters most is that the malicious packages did not need to blend into a transitive application dependency tree to be dangerous. Once a user ran the installed command, the tool fetched off-registry payloads, inherited cloud configuration through environment variables, and exposed screenshot and telemetry features that can leak anything visible on the host. That makes Pepesoft a useful companion read to SleeperGem’s workstation persistence, the jscrambler import-time chain, and PolinRider’s editor and repository lures.
CVE-2026-48815: sigstore-js dropped certificateOIDs checks, weakening JavaScript artifact-verification policy
This week’s most important pure vulnerability disclosure is CVE-2026-48815, because it undermines a trust control many teams may have believed was already enforced. GitHub’s advisory credits Jvr2022, Str1ckl4nd, and Zyy0530 as reporters, while sigstore collaborator Brian DeHamer deserves patch-author credit for shipping the 4.1.1 fix. The bug belongs beside the AsyncAPI compromise and the earlier AntV Mini Shai-Hulud wave as a reminder that valid-looking provenance and safe trust policy are not the same thing.
The operational lesson is that artifact verification can fail quietly when a documented policy knob never reaches the real verifier. If a JavaScript signing gate depended on certificateOIDs, then historical allow decisions may have enforced a broader signer set than reviewers expected. Subscribers should treat that as the verification-side twin of the supply-chain stories above: whether the weakness sits in Sigstore policy enforcement, AsyncAPI’s compromised publish path, or jscrambler’s import-time execution, the common failure is misplaced trust in the normal release path.
Other news:
- No additional Corgea research articles were published in this Wednesday, 15 July through Tuesday, 21 July 2026 window beyond the three stories above.
- For adjacent context, revisit the 14 July briefing, the 7 July briefing, and companion research on Rollup polyfill, Braintree.Net, and PolinRider.
From research to remediation
Check whether this pattern exists in your codebase
Turn this research into a remediation workflow. Scan dependencies and package manifests for similar supply-chain risk, then prioritize fixes with reachability context.