Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyBest value · save 44%$999/year$83.25/mo, billed yearly. Save $789 vs monthly (5+ months free).Monthly$149/monthBilled monthly. Cancel anytime.

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

← Supply chain
LivePatchedSupply chain

Malicious Ruby gem strutil-core delivers testmetest/Shai-Hulud-descendant worm

RubyGems package strutil-core (related: PyPI pystr-codec; lineage shared with npm testmetest worm)

Brought to you byTinkerer Club

The private club for people who own their servers, run their own AI, and pay $0/month for software.

Socket Threat Research (Nov 6 2026) analyzed strutil-core 1.0.1 on RubyGems, published by account jamnajiea: a clean 1.0.0 on Nov 1 was followed less than two hours later by malicious 1.0.1. During gem install, ext/strutil-core/extconf.rb downloads Bun and runs a 5.48 MB credential-stealing worm (testmetest / Miasma lineage descended from the public Shai-Hulud toolkit). The worm steals cloud/CI/registry/SSH/AI-tool/wallet credentials, exfiltrates to paleasbest.top (GitHub/GitLab fallbacks), can republish to RubyGems/npm/PyPI, poisons AI coding tool configs, and can wipe the home directory if a stolen GitHub token returns 401/403. Socket flagged it 70 seconds after publication; RubyGems removed both versions about five hours later. No public dependents or confirmed victims found. Related PyPI sibling pystr-codec used the same collection endpoint. See also the npm-focused testmetest incident.

Why this severity: Install-time credential-stealing worm with token-revocation wiper and multi-ecosystem republish code; gem removed quickly and Socket found no public dependents or confirmed victims

Started
Nov 1, 2026

Follow this incident

Discuss on X ↗

Affected

  • strutil-core 1.0.1 (malicious)
  • strutil-core 1.0.0 (clean seed by same account; both removed)

Fixed in

  • Malicious versions removed from RubyGems; do not install strutil-core — rebuild any host that installed 1.0.1

Timeline3

  1. Socket publishes analysis tying strutil-core 1.0.1 to the testmetest worm (Miasma/Shai-Hulud descendant): install-time Bun runner, credential theft, AI-tool poisoning, conditional home-directory wiper on GitHub token revocation, and RubyGems injector identical to the worm's own module output.

  2. RubyGems account jamnajiea publishes clean strutil-core 1.0.0 (02:19 UTC), then malicious 1.0.1 (04:05 UTC). Socket AI Scanner flags the payload 70 seconds later. RubyGems removes both versions about five hours after the malicious release (~08:52–09:13 UTC per Bitbison).

  3. Socket: PyPI sibling pystr-codec 0.1.0–0.1.2 appears, using the same paleasbest.top/v1/api collection endpoint (separate build from strutil-core).

News & write-ups1

Notes & caveats

Related npm campaign tracked as testmetest-npm-worm-42-armed-github-repos. Socket has not confirmed victims from this gem. If 1.0.1 was installed, stop net-health-checker / pkg-runtime before revoking GitHub tokens (wiper on 401/403), then rotate credentials from a clean device.

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Sponsored

Buy sponsor slot · $149/mo