Malware · 1 source · latest 1d

Malicious RubyGems package strutil-core carries a Shai-Hulud-derived credential-stealing worm

MALWARERubyGemsredteam/daily · 1 source

Severity: High
Sources: 1

What happened

Socket researchers found that the RubyGems package strutil-core 1.0.1 runs a 5.48 MB credential-stealing worm at install time, using a native extension that downloads the Bun runtime. The payload is a new build of the testmetest worm from the Miasma family, which grew out of the public Shai-Hulud toolkit. It collects cloud, CI, registry, SSH, AI coding tool and wallet credentials, tries to republish itself to RubyGems, npm and PyPI, and writes MCP servers and agent instructions into local configurations. RubyGems removed both versions, and no victims have been confirmed.

For IT people · Written by AI from 1 source · Wrong?

What to do

Check whether strutil-core 1.0.1 is installed and remove it if present.
Review systems that installed it for unexpected Bun downloads and check local MCP server and agent configuration files.
Rotate cloud, CI, registry, SSH, AI tool and GitHub credentials stored on any affected machine.

Written by AI from the sources, checked against them

Read the full story at the source