Skip to content
NewA calmer, faster ZeroHour
StoryMalwarehigh

Malicious Ruby gem strutil-core stole credentials before removal

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

RubyGems removed strutil-core 1.0.1 within hours; researchers report no confirmed victims.

A RubyGems package named strutil-core carried a 5.48 MB credential-stealing worm that ran during installation. Account jamnajiea published a clean 1.0.0 on November 1, 2026, then pushed malicious 1.0.1 less than two hours later. On Linux and macOS, the install script downloaded the Bun runtime and ran bundled code targeting cloud, CI, registry, SSH, wallet, and AI coding-tool credentials, then encrypted the data for paleasbest[.]top with GitHub and GitLab fallbacks. Researchers found no public dependents and have not confirmed victims. RubyGems removed both versions within about five hours. Uninstalling the gem does not remove persistence outside the gem directory, and a monitor can delete the home directory if a stolen GitHub token returns 401 or 403.

Key facts
  • Account jamnajiea published clean 1.0.0, then malicious 1.0.1.
  • Payload is described as a testmetest worm build in the Miasma family.
  • A sandbox recorded reads from 51 credential stores.
  • The same domain appears in PyPI pystr-codec 0.1.0 to 0.1.2.
  • The payload skips Russian, Ukrainian, Belarusian, and some other languages.
  • Socket's scanner flagged the package after 70 seconds.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Nov 1, 2026Clean strutil-core 1.0.0 published · GBHackers
  2. Nov 1, 2026Malicious version 1.0.1 pushed under two hours later · GBHackers
  3. Nov 1, 2026RubyGems removed both versions within about five hours · Cyber Security News

What each outlet adds

beyond the shared facts
  • GBHackersLinks paleasbest[.]top to PyPI pystr-codec and notes persistence survives uninstall.
  • Cyber Security NewsAdds the 70-second scanner flag and language-based skip behavior.
Products
strutil-corepystr-codec
Malware
testmetestMiasmaShai-Hulud
Organizations
SocketRubyGemsStepSecurity

Coverage

oldest first · one row per article · UTC
  1. · 1d ago GBHackersFirst report

    Malicious Ruby gem strutil-core installs a credential-stealing worm

    Socket found no public dependents and confirmed no victims; RubyGems removed both versions within about five hours.

  2. · 1d ago Cyber Security News

    Malicious Ruby gem steals credentials and backdoors AI coding tools

    strutil-core 1.0.1 was live about five hours; revoking a stolen GitHub token can wipe the home folder.