Shai-Hulud descendant / Miasma worm: strutil-core Ruby gem — malicious 1.0.1 steals credentials, poisons AI tools, wipes files on token revocation
Severity: critical · Patch status: no-fix-needed · Since 2026-11-06
Socket's Threat Research Team identified strutil-core 1.0.1 on RubyGems as a malicious package running a 5.48 MB credential-stealing worm at install time. A clean 1.0.0 was published 2026-11-01 and the malicious 1.0.1 followed under two hours later; Socket's AI Scanner flagged it 70 seconds after publication and RubyGems removed both versions about five hours later. The payload, a new build of the testmetest worm from the Miasma family descended from the publicly released Shai-Hulud toolkit, downloads the Bun runtime via a fake native extension, steals cloud, CI, registry, SSH, AI-tool and wallet credentials exfiltrated to paleasbest[.]top, propagates via RubyGems/npm/PyPI/GitHub/GitLab/SSH, installs a Python backdoor driven by signed GitHub commit messages, poisons MCP servers and agent configs, and deletes the user's home directory if a stolen GitHub token returns 401/403. No victims or dependent projects confirmed; both versions removed.
What to do
- Audit installed gems and CI logs for strutil-core 1.0.0/1.0.1 and for ext/<gem>/index.js or extconf.rb anomalies in any gem
- Rotate all credentials the payload targets: cloud, CI, package registry (RubyGems, npm, PyPI), SSH keys, GitHub/GitLab tokens, AI coding tool and wallet secrets
- Check for persistence: Python backdoors, MCP server entries, session hooks and modified agent instruction files in local configs and repositories
- Block the exfiltration domain paleasbest[.]top and monitor for connections to it
- Review GitHub audit logs for unexpected commits or signed commit-message activity indicating the backdoor channel
- Pin and verify gem dependencies; avoid installing gems with native extensions that download external runtimes
Sources
All live incidents on Threat Watch
