Malware · 1 source · latest 1d

Malicious RubyGems package strutil-core carries a Shai-Hulud-derived credential-stealing worm

MALWARERubyGemsredteam/daily · 1 source

Severity: High
Sources: 1

What happened

Malicious strutil-core 1.0.1 was published on 1 November, after a clean 1.0.0 from the same account less than two hours earlier. Its ext/strutil-core/extconf.rb fetches Bun 1.2.18 and runs index.js during gem install. The testmetest/Miasma-family payload exfiltrates cloud, CI, registry, SSH, AI tool and wallet credentials, republishes to RubyGems, npm and PyPI, installs a Python backdoor driven by signed GitHub commit messages, and deletes the home directory if a stolen GitHub token returns 401 or 403. Defenders should search for strutil-core 1.0.1 and Bun 1.2.18 downloads, review MCP and agent config files, and rotate exposed credentials. Findings are from static analysis and one sandbox run, with no confirmed victims.

For security analysts · Written by AI from 1 source · Wrong?

What to do

Check whether strutil-core 1.0.1 is installed and remove it if present.
Review systems that installed it for unexpected Bun downloads and check local MCP server and agent configuration files.
Rotate cloud, CI, registry, SSH, AI tool and GitHub credentials stored on any affected machine.

Written by AI from the sources, checked against them

Read the full story at the source