Malicious Ruby gem steals credentials and backdoors AI coding tools
Original title: Malicious Ruby Gem Steals 51 Types of Credentials and Plants Backdoors in AI Coding Tools
strutil-core 1.0.1 was live about five hours; revoking a stolen GitHub token can wipe the home folder.
Fake RubyGems package strutil-core 1.0.1 ran a credential-stealing worm at install through extconf.rb and planted backdoors in AI coding-tool settings. Socket says a sandbox recorded reads from 51 credential stores and exfiltration to paleasbest[.]top, with GitHub or GitLab fallbacks. RubyGems removed both versions within hours. Researchers found no public dependents and have not confirmed victims.
Unconfirmed: Socket has not confirmed infections, and shared Shai-Hulud code does not prove one operator.
- Account jamnajiea published clean 1.0.0 on November 1, then malicious 1.0.1.
- The payload was 5.48 MB; Socket's scanner flagged it after 70 seconds.
- A monitor deletes the home folder if a stolen GitHub token returns 401 or 403.
- Socket links the build to the testmetest worm in the Miasma family.
- It skips systems set to Russian, Ukrainian, Belarusian, and some other languages.
Impact: credential theft and possible home-folder deletion
| Product | Affected |
|---|---|
| strutil-core | 1.0.1 |
- 1.Isolate the host, then remove net-health-checker and pkg-runtime before revoking the GitHub token.
- 2.Rotate all keys from a clean device and rebuild the host.
- 3.Check Gemfile.lock, CI caches, images, and AI settings for unknown workspace-tools entries.
- ATT&CK
- T1195.001 Compromise Software Dependencies and Development ToolsT1552.001 Credentials In FilesT1543.002 Systemd ServiceT1485 Data Destruction
- Products
- strutil-core
- Malware
- testmetestMiasmaShai-Hulud
- Organizations
- SocketRubyGemsStepSecurity
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | paleasbest.top | across 17 regions. The stolen data is encrypted and sent to paleasbest[.]top. If that fails, the worm creates a public GitHub reposito |
| sha256 | 306c1deec402e8b4a6478e7f0fe02194bcd224d37d8fc6ba61ad1951e8abd7a9 | f021e1102123971cfd83acc0 SHA-256, ext/strutil-core/index.js 306c1deec402e8b4a6478e7f0fe02194bcd224d37d8fc6ba61ad1951e8abd7a9 SHA-256, ext/strutil-core/extconf.rb c5264f3b9cf2f95c83a70b |
| sha256 | 3b3f6e1bde0b28b015030a81a6d805b5b5306dc3f021e1102123971cfd83acc0 | s://paleasbest[.]top/v1/api SHA-256, strutil-core-1.0.1.gem 3b3f6e1bde0b28b015030a81a6d805b5b5306dc3f021e1102123971cfd83acc0 SHA-256, ext/strutil-core/index.js 306c1deec402e8b4a6478e7f |
| sha256 | 66c1c6b6b2c47e96fa5fd328338b939e1360511ab5eb2dda6d9112f592259d6b | ab8abc262b853dbbcd5386c3a8a9c74769 SHA-256, strutil_core.rb 66c1c6b6b2c47e96fa5fd328338b939e1360511ab5eb2dda6d9112f592259d6b SHA-256, embedded sync.py c7ef186aa59b67d9b198a14f6dc8aaee6 |
| sha256 | c5264f3b9cf2f95c83a70b7dd7430aab8abc262b853dbbcd5386c3a8a9c74769 | 8fc6ba61ad1951e8abd7a9 SHA-256, ext/strutil-core/extconf.rb c5264f3b9cf2f95c83a70b7dd7430aab8abc262b853dbbcd5386c3a8a9c74769 SHA-256, strutil_core.rb 66c1c6b6b2c47e96fa5fd328338b939e13 |
| sha256 | c78daf27c42c3929758b24c2ef0baf65eea81b26b0fddfe8a5b748672d40d5f5 | e5c2b9ae5d6bdd053f4f44c98f309d3 SHA-256, node_win.napi.node c78daf27c42c3929758b24c2ef0baf65eea81b26b0fddfe8a5b748672d40d5f5 Related PyPI package pystr-codec 0.1.0, 0.1.1, 0.1.2 (same |
| sha256 | c7ef186aa59b67d9b198a14f6dc8aaee6dd86510ac7c37d28f65d310cd846411 | e1360511ab5eb2dda6d9112f592259d6b SHA-256, embedded sync.py c7ef186aa59b67d9b198a14f6dc8aaee6dd86510ac7c37d28f65d310cd846411 SHA-256, net-health-checker installer e29a5319888319b51345a |
| sha256 | e29a5319888319b51345ab8e3e009938ee5c2b9ae5d6bdd053f4f44c98f309d3 | c37d28f65d310cd846411 SHA-256, net-health-checker installer e29a5319888319b51345ab8e3e009938ee5c2b9ae5d6bdd053f4f44c98f309d3 SHA-256, node_win.napi.node c78daf27c42c3929758b24c2ef0baf6 |
| url | https://paleasbest.top/v1/api | l-core (nonexistent repository) Domain paleasbest[.]top URL hxxps://paleasbest[.]top/v1/api SHA-256, strutil-core-1.0.1.gem 3b3f6e1bde0b28b015030a81a |
From the original article
5 min read at cybersecuritynews.com
A fake Ruby package called strutil-core looked like a harmless text helper. In fact, it ran a credential-stealing worm the moment a developer installed it. The worm also wrote backdoors into the settings of AI coding tools.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.