Supply Chain · Watch Sunday · 19 July 2026 End-of-day synthesis 4 watches · 2 items

From the watchtower — what crossed the wire today.

A four-times-a-day standing watch on the open-source supply chain. Each pass pulls newly disclosed CVEs, freshly catalogued KEV adds, and active attacks reported in the wild — then ranks them by severity for the day.

The story of the day — SleeperGem's dormant-maintainer-account hijack on RubyGems was the day's lone confirmed supply-chain hit, on an otherwise quiet Sunday.

Sunday was thin by this watch's usual standard: two items cleared the bar across all three fetchers, and only one touched the package ecosystem directly. No new GHSA disclosures and no new CISA KEV adds landed in the last six hours.

That one was SleeperGem: two long-dormant RubyGems maintainer accounts were hijacked and used to push malicious versions into gems with years of clean history, one carrying over 500,000 lifetime downloads. It's the same playbook that's hit npm and PyPI repeatedly this year — attackers don't need a zero-day, just patience for an account that hasn't logged in for months — so a quiet changelog is no longer a safety signal on any registry. Separately, CERT-UA tied a Sandworm sub-cluster (UAC-0145) to a ClickFix CAPTCHA campaign against Ukrainian targets; filed as context, since it's the technique rather than the registries that rhymes with this year's crimeware trend.

→ Operational priority for the night diff Gemfile.lock against last known-good for any RubyGems dependency that hasn't shipped in months, and treat an unexpected version bump from a dormant gem as suspect until you've read the diff yourself.

12:00 ET · Forenoon Watch

Context · The Hacker News · CERT-UA ·added 12:00 ET

UAC-0145 (Sandworm sub-cluster) uses ClickFix CAPTCHA lures against Ukrainian targets

CERT-UA attributes a fresh ClickFix campaign to UAC-0145, a sub-cluster of the Russian GRU-linked Sandworm group, tricking targets into pasting a malicious command into Win+R to self-install a credential/data stealer. It's the same clipboard-hijack social-engineering shape this watch has flagged in commodity infostealer campaigns (ACR Stealer) this week, now with a state-actor byline — the technique has fully crossed from crimeware into APT tradecraft. Nothing here touches package registries directly; filed as context for anyone tracking ClickFix as a recurring initial-access vector rather than as a supply-chain compromise in its own right.

06:00 ET · Morning Watch

Critical · Aikido Security ·added 06:00 ET

SleeperGem: dormant RubyGems maintainer accounts hijacked to backdoor trusted gems

Two long-dormant RubyGems maintainer accounts were compromised and used to push malicious versions into gems that were otherwise trusted and stable — one of the affected gems has over 500,000 lifetime downloads. It's the same TTP that's hit npm and PyPI repeatedly this year: attackers don't need a zero-day, just patience and a maintainer account that hasn't logged in for months, so a clean changelog history is no longer a signal of safety. Diff Gemfile.lock against the last known-good state for any of the affected gems, and treat an unexpected version bump from a gem that hasn't shipped in a long time as suspect until you've read the diff yourself.