Ruby's Bundler Cooldown Feature Mitigated SleeperGem Attack 45 Days Before Exploit

Bundler 4.0.13 introduced a cooldown feature on June 3, 2026, that delays new gem installations to prevent supply chain attacks. On July 19, attackers compromised three Ruby gems, including one impersonating Microsoft's Git Credential Manager, but the cooldown limited the blast radius. The malicious payload targeted developer machines, dropping backdoors via native binaries, but downloads of the malicious versions were minimal and yanked.