The original headline is 10 words: "Ruby Shipped the Fix for SleeperGem 45 Days Before It Happened"

Short summary

Bundler 4.0.13 shipped a cooldown feature 45 days before the SleeperGem supply-chain attack, which pushed malicious versions of three Ruby gems in July 2026. The malware sits dormant in CI environments and activates only on local machines, dropping a persistent daemon. Adding `cooldown: 7` to your Gemfile source line would have blocked every malicious version for as long as it existed. The feature is unset by default and fails closed if no version satisfies the window.

• •Bundler cooldown feature shipped 45 days before SleeperGem attack and would have blocked all malicious versions
• •Malware scans for ~30 CI environment variables and only activates on local machines, dropping a persistent daemon
• •Cooldown is unset by default; one Gemfile line (`cooldown: 7`) enables protection that fails closed safely

Generated with AI, which can make mistakes.