{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Malicious Ruby gem strutil-core delivers testmetest/Shai-Hulud-descendant worm · updates",
  "home_page_url": "https://pwn.watch/i/strutil-core-rubygems-testmetest-worm-nov-2026",
  "feed_url": "https://pwn.watch/i/strutil-core-rubygems-testmetest-worm-nov-2026/feed.json",
  "description": "Socket Threat Research (Nov 6 2026) analyzed strutil-core 1.0.1 on RubyGems, published by account jamnajiea: a clean 1.0.0 on Nov 1 was followed less than two hours later by malicious 1.0.1. During gem install, ext/strutil-core/extconf.rb downloads Bun and runs a 5.48 MB credential-stealing worm (testmetest / Miasma lineage descended from the public Shai-Hulud toolkit). The worm steals cloud/CI/registry/SSH/AI-tool/wallet credentials, exfiltrates to paleasbest.top (GitHub/GitLab fallbacks), can republish to RubyGems/npm/PyPI, poisons AI coding tool configs, and can wipe the home directory if a stolen GitHub token returns 401/403. Socket flagged it 70 seconds after publication; RubyGems removed both versions about five hours later. No public dependents or confirmed victims found. Related PyPI sibling pystr-codec used the same collection endpoint. See also the npm-focused testmetest incident.",
  "language": "en",
  "_pwn": {
    "slug": "strutil-core-rubygems-testmetest-worm-nov-2026",
    "severity": "high",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/strutil-core-rubygems-testmetest-worm-nov-2026/feed.xml",
    "llms": "https://pwn.watch/i/strutil-core-rubygems-testmetest-worm-nov-2026/llms.txt",
    "json": "https://pwn.watch/i/strutil-core-rubygems-testmetest-worm-nov-2026.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/strutil-core-rubygems-testmetest-worm-nov-2026#2026-11-06-93b9fd1f",
      "url": "https://pwn.watch/i/strutil-core-rubygems-testmetest-worm-nov-2026#2026-11-06-93b9fd1f",
      "title": "Malicious Ruby gem strutil-core delivers testmetest/Shai-Hulud-descendant worm: Socket publishes analysis tying strutil-core 1.0.1 to the testmetest worm (Miasma/Shai-Hulud descendant): install-time Bun runner, credential theft, AI-tool poisoning, conditional home-directory wiper on GitHub token revocation, and RubyGems injector identical to the worm's own module output.",
      "content_text": "Malicious Ruby gem strutil-core delivers testmetest/Shai-Hulud-descendant worm: Socket publishes analysis tying strutil-core 1.0.1 to the testmetest worm (Miasma/Shai-Hulud descendant): install-time Bun runner, credential theft, AI-tool poisoning, conditional home-directory wiper on GitHub token revocation, and RubyGems injector identical to the worm's own module output.\n\nSource: https://socket.dev/blog/shai-hulud-descendant-malicious-ruby-gem",
      "date_published": "2026-11-06T00:00:00.000Z",
      "external_url": "https://socket.dev/blog/shai-hulud-descendant-malicious-ruby-gem",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/strutil-core-rubygems-testmetest-worm-nov-2026#2026-11-01-99b76fd6",
      "url": "https://pwn.watch/i/strutil-core-rubygems-testmetest-worm-nov-2026#2026-11-01-99b76fd6",
      "title": "Malicious Ruby gem strutil-core delivers testmetest/Shai-Hulud-descendant worm: RubyGems account jamnajiea publishes clean strutil-core 1.0.0 (02:19 UTC), then malicious 1.0.1 (04:05 UTC). Socket AI Scanner flags the payload 70 seconds later. RubyGems removes both versions about five hours after the malicious release (~08:52–09:13 UTC per Bitbison).",
      "content_text": "Malicious Ruby gem strutil-core delivers testmetest/Shai-Hulud-descendant worm: RubyGems account jamnajiea publishes clean strutil-core 1.0.0 (02:19 UTC), then malicious 1.0.1 (04:05 UTC). Socket AI Scanner flags the payload 70 seconds later. RubyGems removes both versions about five hours after the malicious release (~08:52–09:13 UTC per Bitbison).\n\nSource: https://socket.dev/blog/shai-hulud-descendant-malicious-ruby-gem",
      "date_published": "2026-11-01T00:00:00.000Z",
      "external_url": "https://socket.dev/blog/shai-hulud-descendant-malicious-ruby-gem",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/strutil-core-rubygems-testmetest-worm-nov-2026#2026-10-31-27c13d68",
      "url": "https://pwn.watch/i/strutil-core-rubygems-testmetest-worm-nov-2026#2026-10-31-27c13d68",
      "title": "Malicious Ruby gem strutil-core delivers testmetest/Shai-Hulud-descendant worm: Socket: PyPI sibling pystr-codec 0.1.0–0.1.2 appears, using the same paleasbest.top/v1/api collection endpoint (separate build from strutil-core).",
      "content_text": "Malicious Ruby gem strutil-core delivers testmetest/Shai-Hulud-descendant worm: Socket: PyPI sibling pystr-codec 0.1.0–0.1.2 appears, using the same paleasbest.top/v1/api collection endpoint (separate build from strutil-core).\n\nSource: https://socket.dev/blog/shai-hulud-descendant-malicious-ruby-gem",
      "date_published": "2026-10-31T00:00:00.000Z",
      "external_url": "https://socket.dev/blog/shai-hulud-descendant-malicious-ruby-gem",
      "tags": [
        "high"
      ]
    }
  ]
}