Malicious Ruby gem strutil-core delivers testmetest/Shai-Hulud-descendant worm · updates https://pwn.watch/i/strutil-core-rubygems-testmetest-worm-nov-2026 Socket Threat Research (Nov 6 2026) analyzed strutil-core 1.0.1 on RubyGems, published by account jamnajiea: a clean 1.0.0 on Nov 1 was followed less than two hours later by malicious 1.0.1. During gem install, ext/strutil-core/extconf.rb downloads Bun and runs a 5.48 MB credential-stealing worm (testmetest / Miasma lineage descended from the public Shai-Hulud toolkit). The worm steals cloud/CI/registry/SSH/AI-tool/wallet credentials, exfiltrates to paleasbest.top (GitHub/GitLab fallbacks), can republish to RubyGems/npm/PyPI, poisons AI coding tool configs, and can wipe the home directory if a stolen GitHub token returns 401/403. Socket flagged it 70 seconds after publication; RubyGems removed both versions about five hours later. No public dependents or confirmed victims found. Related PyPI sibling pystr-codec used the same collection endpoint. See also the npm-focused testmetest incident. en Fri, 06 Nov 2026 00:00:00 GMT Malicious Ruby gem strutil-core delivers testmetest/Shai-Hulud-descendant worm: Socket publishes analysis tying strutil-core 1.0.1 to the testmetest worm (Miasma/Shai-Hulud descendant): install-time Bun runner, credential theft, AI-tool poisoning, conditional home-directory wiper on GitHub token revocation, and RubyGems injector identical to the worm's own module output. https://pwn.watch/i/strutil-core-rubygems-testmetest-worm-nov-2026 https://pwn.watch/i/strutil-core-rubygems-testmetest-worm-nov-2026#2026-11-06-93b9fd1f Fri, 06 Nov 2026 00:00:00 GMT high <p><a href="https://socket.dev/blog/shai-hulud-descendant-malicious-ruby-gem">Source</a></p> Malicious Ruby gem strutil-core delivers testmetest/Shai-Hulud-descendant worm: RubyGems account jamnajiea publishes clean strutil-core 1.0.0 (02:19 UTC), then malicious 1.0.1 (04:05 UTC). Socket AI Scanner flags the payload 70 seconds later. RubyGems removes both versions about five hours after the malicious release (~08:52–09:13 UTC per Bitbison). https://pwn.watch/i/strutil-core-rubygems-testmetest-worm-nov-2026 https://pwn.watch/i/strutil-core-rubygems-testmetest-worm-nov-2026#2026-11-01-99b76fd6 Sun, 01 Nov 2026 00:00:00 GMT high <p><a href="https://socket.dev/blog/shai-hulud-descendant-malicious-ruby-gem">Source</a></p> Malicious Ruby gem strutil-core delivers testmetest/Shai-Hulud-descendant worm: Socket: PyPI sibling pystr-codec 0.1.0–0.1.2 appears, using the same paleasbest.top/v1/api collection endpoint (separate build from strutil-core). https://pwn.watch/i/strutil-core-rubygems-testmetest-worm-nov-2026 https://pwn.watch/i/strutil-core-rubygems-testmetest-worm-nov-2026#2026-10-31-27c13d68 Sat, 31 Oct 2026 00:00:00 GMT high <p><a href="https://socket.dev/blog/shai-hulud-descendant-malicious-ruby-gem">Source</a></p>