Malicious Ruby Gem Strutil-Core Steals Credentials and Deploys Backdoors

• •The strutil-core Ruby gem runs a credential-stealing worm upon installation.
• •It can delete user directories if a revoked GitHub token is detected.
• •No confirmed victims have been reported, but the gem's capabilities pose a significant risk.

A malicious Ruby gem named strutil-core was published on RubyGems, masquerading as a harmless text helper. Upon installation, it executes a credential-stealing worm that collects various types of credentials and can install backdoors in AI coding tools. The worm is capable of deleting user directories if a stolen GitHub token is revoked. The gem was published by the account jamnajiea, with a clean version released just two hours before the malicious one. Socket's Threat Research Team identified the gem's payload as a new build of the testmetest worm, linked to the Shai-Hulud toolkit. The malicious gem was flagged by Socket's AI Scanner shortly after publication, and both versions were removed by RubyGems within hours. No confirmed victims have been reported yet, but the potential for widespread impact exists due to the gem's self-propagation capabilities.