Malicious Ruby gem strutil-core installs a credential-stealing worm
Original title: Shai-Hulud Descendant Hides in Malicious Ruby Gem to Steal Developer Secrets and Poison AI Coding Tools
Socket found no public dependents and confirmed no victims; RubyGems removed both versions within about five hours.
A RubyGems package named strutil-core carried a 5.48 MB credential-stealing worm that ran during installation. Account jamnajiea published a clean 1.0.0 on November 1, 2026, then pushed malicious 1.0.1 less than two hours later. On Linux and macOS, extconf.rb downloads the Bun runtime and runs bundled index.js, then targets cloud, CI, registry, SSH, wallet and AI coding-tool credentials. Stolen data is encrypted and sent to paleasbest[.]top, with GitHub and GitLab fallbacks.
Unconfirmed: Socket confirmed no victims, and shared Shai-Hulud code does not prove one operator.
- The payload is described as a new build of the testmetest worm in the Miasma family.
- Bitbison’s sandbox recorded reads from 51 credential stores.
- A stolen GitHub token can trigger home-directory deletion after a 401 or 403.
- The same domain appears in PyPI package pystr-codec versions 0.1.0 to 0.1.2.
- Uninstalling the gem does not remove persistence outside the gem directory.
Impact: Steals developer, cloud, CI, wallet and AI-tool credentials
| Product | Affected |
|---|---|
| strutil-core | 1.0.1 |
- 1.If 1.0.1 was installed, isolate the host and remove net-health-checker and pkg-runtime before revoking tokens.
- 2.Rotate credentials from a clean device and rebuild the machine.
- 3.Check for paleasbest[.]top and related republishing or AI-tool configuration changes.
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1552.001 Credentials In FilesT1059.007 JavaScriptT1485 Data Destruction
- Products
- strutil-corepystr-codec
- Malware
- testmetestMiasmaShai-Hulud
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | paleasbest.top | disable Harden-Runner. Stolen data is encrypted and sent to paleasbest[.]top, with GitHub and GitLab fallbacks. The code also contains |
| domain | rubygems.org | s. The strutil-core attack chain, from the malicious gem on RubyGems.org to credential theft (Source : Socket). A Python backdoor, s |
| url | https://paleasbest.top/v1/api | ork Indicator Domain paleasbest[.]top Network Indicator URL hxxps://paleasbest[.]top/v1/api Note: IP addresses and domains are intentionally defanged |
From the original article
3 min read at gbhackers.com
A malicious RubyGems package named strutil-core carried a 5. 48 MB credential-stealing worm that ran as soon as a developer installed it. It is a new build of the testmetest worm, part of the Miasma family that grew out of the publicly released Shai-Hulud toolkit.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.