Malware · 1 source · latest 1d

Malicious RubyGems package strutil-core carries a Shai-Hulud-derived credential-stealing worm

MALWARERubyGemsredteam/daily · 1 source

Severity: High
Sources: 1

What happened

A malicious software package called strutil-core was published to RubyGems, a site where developers share Ruby code. When installed, it secretly runs a worm that steals passwords and access keys and tries to spread to other packages. The package was removed about five hours after the malicious version appeared, and no victims have been confirmed.

Like I’m new · Written by AI from 1 source · Wrong?

What to do

Check whether strutil-core 1.0.1 is installed and remove it if present.
Review systems that installed it for unexpected Bun downloads and check local MCP server and agent configuration files.
Rotate cloud, CI, registry, SSH, AI tool and GitHub credentials stored on any affected machine.

Written by AI from the sources, checked against them

Read the full story at the source