--- id: "CMP-202611-4oqn2e" page: "https://infrastack.ai/live/CMP-202611-4oqn2e" kind: "campaign" aliases: [] title: "Malicious Ruby gem strutil-core 1.0.1 runs a Shai-Hulud-style worm (testmetest/Miasma) on gem install: steals cloud, CI and AI tool credentials, poisons AI coding tools, and wipes the home folder if you revoke the stolen GitHub token (Socket)" severity: "high" cvss: null epss: null exploited: false status: "open" category: "package" products: [{"name": "strutil-core", "fixed": [], "affected": "= 1.0.1", "ecosystem": "rubygems"}, {"name": "RubyGems", "fixed": [], "ecosystem": "rubygems"}, {"name": "GitHub Actions", "fixed": []}] ecosystems: [] tags: ["campaign", "early-warning"] not_affected_if: [] published_at: null first_seen_at: "2026-11-06T18:44:15+00:00" updated_at: "2026-11-06T18:45:51+00:00" sources: [{"source": "analyst", "url": "https://socket.dev/blog/shai-hulud-descendant-malicious-ruby-gem", "first_seen_at": "2026-11-06T18:44:15+00:00", "cites": ["https://socket.dev/blog/shai-hulud-descendant-malicious-ruby-gem"]}] exploit_sources: [] --- # Malicious Ruby gem strutil-core 1.0.1 runs a Shai-Hulud-style worm (testmetest/Miasma) on gem install: steals cloud, CI and AI tool credentials, poisons AI coding tools, and wipes the home folder if you revoke the stolen GitHub token (Socket) Link for people: https://infrastack.ai/live/CMP-202611-4oqn2e (this .md is for agents) Socket found RubyGems package strutil-core 1.0.1, published 1 Nov 2026 04:05 UTC by account jamnajiea and removed by RubyGems about five hours later. During gem install or bundle install its native-extension script (ext/strutil-core/extconf.rb) downloads Bun 1.2.18 and runs a 5.48 MB worm, a newer build of the testmetest worm (Miasma family, built from the leaked Shai-Hulud code). The worm steals cloud (AWS, Azure, GCP), Kubernetes, Vault, registry (RubyGems, npm, PyPI, JFrog), GitHub/GitLab, SSH, Docker, wallet and AI coding tool credentials (.claude/.credentials.json, .codex/auth.json). On GitHub Actions runners it scrapes secrets from runner memory and turns off StepSecurity Harden-Runner. It installs a backdoor that runs attacker scripts, plants MCP servers, SessionStart hooks, CLAUDE.md/AGENTS.md and VS Code tasks in home folders and repositories so AI coding tools re-run it, and contains code to republish to RubyGems, npm and PyPI and spread over SSH. If a stolen GitHub token starts returning 401/403, a monitor deletes the user's home directory. No victims or downstream infected packages confirmed so far; 0 recorded downloads of 1.0.1 when first tracked, and real install count unknown. The PyPI package pystr-codec 0.1.0-0.1.2 (MAL-2026-18432) uses the same collection server. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - rubygems:strutil-core affected = 1.0.1 fixed no fixed version listed - rubygems:RubyGems affected range not listed fixed no fixed version listed - :GitHub Actions affected range not listed fixed no fixed version listed ## How to check Gemfile.lock, CI caches or container images containing strutil-core (esp. 1.0.1); gems you maintain that gained an unexpected ext/*/extconf.rb or extensions: entry (installer SHA-256 c5264f3b9cf2f95c83a70b7dd7430aab8abc262b853dbbcd5386c3a8a9c74769). Egress to paleasbest[.]top (hxxps://paleasbest[.]top/v1/api). Host artifacts: systemd user service pkg-runtime or LaunchAgent com.user.pkg-runtime, ~/.local/share/runtimes/sync.py, net-health-checker service with ~/.local/bin/net-health-checker.sh and ~/.config/net-health-checker/token, ~/.config/index.js, /var/tmp/.fontconfig_state, bun run from /tmp/.b_ started by Ruby, sudo python3 reading /proc//mem on CI runners. Unknown MCP server named workspace-tools or SessionStart hooks in AI tool configs. In GitHub orgs: new public repos described project-utils with adjective-noun-number names, commits with AutoSyncComplete or skip-checks:true, chore/ci-* branches, a 'CodeQL' workflow uploading a scan-output artifact, new .github/init.js, AGENTS.md, CLAUDE.md, .claude/settings.json, .cursor/mcp.json, .vscode/tasks.json; GitHub commits mentioning msync-3f7a; GitLab CI job cache_sync. Hashes: gem 3b3f6e1bde0b28b015030a81a6d805b5b5306dc3f021e1102123971cfd83acc0, index.js 306c1deec402e8b4a6478e7f0fe02194bcd224d37d8fc6ba61ad1951e8abd7a9, sync.py c7ef186aa59b67d9b198a14f6dc8aaee6dd86510ac7c37d28f65d310cd846411, net-health-checker installer e29a5319888319b51345ab8e3e009938ee5c2b9ae5d6bdd053f4f44c98f309d3. ## Fix If strutil-core 1.0.1 was installed anywhere, isolate that host and treat every credential reachable from it as stolen. BEFORE revoking any GitHub token, stop and remove the net-health-checker and pkg-runtime services (systemd units or LaunchAgents), or revoking the token wipes the home folder. Then rotate RubyGems, npm, PyPI, GitHub, GitLab, cloud, SSH, Vault, Kubernetes and AI provider keys from a clean device, and rebuild the host. Remove the planted workspace-tools MCP entries, SessionStart hooks and repo files (.github/init.js, AGENTS.md, CLAUDE.md, .vscode/tasks.json). Block paleasbest[.]top. Removing the gem alone does not clean an infection. ## Timeline - 2026-11-06T18:44:15+00:00 analyst https://socket.dev/blog/shai-hulud-descendant-malicious-ruby-gem ## Documents - [describes] @SocketSecurity: 💎 Socket researchers uncovered a Shai-Hulud descendant in a malicious Ruby gem, https://x.com/SocketSecurity/status/2118768788757754350 - [describes] Shai-Hulud Descendant Surfaces in Malicious Ruby Gem That Steals Credentials and Poisons AI Tools (Socket) https://socket.dev/blog/shai-hulud-descendant-malicious-ruby-gem - [mentions] StepSecurity: Malicious Files: Find What Supply Chain Attacks Leave Behind in Your GitHub Repositories and on Developer Machines https://www.stepsecurity.io/blog/malicious-files-find-what-supply-chain-attacks-leave-behind-in-your-github-repositories-and-on-developer-machines - [mentions] Socket: Shai-Hulud Descendant Surfaces in Malicious Ruby Gem That Steals Credentials and Poisons AI Tools https://socket.dev/blog/shai-hulud-descendant-malicious-ruby-gem?utm_medium=feed --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_