# Malicious Ruby gem strutil-core delivers testmetest/Shai-Hulud-descendant worm · pwn.watch > Socket Threat Research (Nov 6 2026) analyzed strutil-core 1.0.1 on RubyGems, published by account jamnajiea: a clean 1.0.0 on Nov 1 was followed less than two hours later by malicious 1.0.1. During gem install, ext/strutil-core/extconf.rb downloads Bun and runs a 5.48 MB credential-stealing worm (testmetest / Miasma lineage descended from the public Shai-Hulud toolkit). The worm steals cloud/CI/registry/SSH/AI-tool/wallet credentials, exfiltrates to paleasbest.top (GitHub/GitLab fallbacks), can republish to RubyGems/npm/PyPI, poisons AI coding tool configs, and can wipe the home directory if a stolen GitHub token returns 401/403. Socket flagged it 70 seconds after publication; RubyGems removed both versions about five hours later. No public dependents or confirmed victims found. Related PyPI sibling pystr-codec used the same collection endpoint. See also the npm-focused testmetest incident. Page: https://pwn.watch/i/strutil-core-rubygems-testmetest-worm-nov-2026 · generated 2026-11-07T21:03:56.857Z ## Status - Severity: high · status: live · patch: patched - Product: RubyGems package strutil-core (related: PyPI pystr-codec; lineage shared with npm testmetest worm) - Started: 2026-11-01 - Affected: strutil-core 1.0.1 (malicious); strutil-core 1.0.0 (clean seed by same account; both removed) - Fixed in: Malicious versions removed from RubyGems; do not install strutil-core — rebuild any host that installed 1.0.1 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/strutil-core-rubygems-testmetest-worm-nov-2026/feed.xml - JSON Feed: https://pwn.watch/i/strutil-core-rubygems-testmetest-worm-nov-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/strutil-core-rubygems-testmetest-worm-nov-2026.json - This file: https://pwn.watch/i/strutil-core-rubygems-testmetest-worm-nov-2026/llms.txt ## Updates (newest first) - 2026-11-06: Socket publishes analysis tying strutil-core 1.0.1 to the testmetest worm (Miasma/Shai-Hulud descendant): install-time Bun runner, credential theft, AI-tool poisoning, conditional home-directory wiper on GitHub token revocation, and RubyGems injector identical to the worm's own module output. (https://socket.dev/blog/shai-hulud-descendant-malicious-ruby-gem) - 2026-11-01: RubyGems account jamnajiea publishes clean strutil-core 1.0.0 (02:19 UTC), then malicious 1.0.1 (04:05 UTC). Socket AI Scanner flags the payload 70 seconds later. RubyGems removes both versions about five hours after the malicious release (~08:52–09:13 UTC per Bitbison). (https://socket.dev/blog/shai-hulud-descendant-malicious-ruby-gem) - 2026-10-31: Socket: PyPI sibling pystr-codec 0.1.0–0.1.2 appears, using the same paleasbest.top/v1/api collection endpoint (separate build from strutil-core). (https://socket.dev/blog/shai-hulud-descendant-malicious-ruby-gem) ## Fix brief # Security brief: Malicious Ruby gem strutil-core delivers testmetest/Shai-Hulud-descendant worm Source: https://pwn.watch/i/strutil-core-rubygems-testmetest-worm-nov-2026 · status: live · severity: high · updated Nov 7, 2026, 02:30 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is Socket Threat Research (Nov 6 2026) analyzed strutil-core 1.0.1 on RubyGems, published by account jamnajiea: a clean 1.0.0 on Nov 1 was followed less than two hours later by malicious 1.0.1. During gem install, ext/strutil-core/extconf.rb downloads Bun and runs a 5.48 MB credential-stealing worm (testmetest / Miasma lineage descended from the public Shai-Hulud toolkit). The worm steals cloud/CI/registry/SSH/AI-tool/wallet credentials, exfiltrates to paleasbest.top (GitHub/GitLab fallbacks), can republish to RubyGems/npm/PyPI, poisons AI coding tool configs, and can wipe the home directory if a stolen GitHub token returns 401/403. Socket flagged it 70 seconds after publication; RubyGems removed both versions about five hours later. No public dependents or confirmed victims found. Related PyPI sibling pystr-codec used the same collection endpoint. See also the npm-focused testmetest incident. Severity detail: Install-time credential-stealing worm with token-revocation wiper and multi-ecosystem republish code; gem removed quickly and Socket found no public dependents or confirmed victims - Product: RubyGems package strutil-core (related: PyPI pystr-codec; lineage shared with npm testmetest worm) ## Affected versions - strutil-core 1.0.1 (malicious) - strutil-core 1.0.0 (clean seed by same account; both removed) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - Malicious versions removed from RubyGems; do not install strutil-core — rebuild any host that installed 1.0.1 After upgrading, re-run the checks above and redeploy/restart the affected services. ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes Check Gemfile.lock / CI caches / images for strutil-core. Treat hosts that installed 1.0.1 as compromised. Cross-link readers to the testmetest npm incident for the broader campaign. ## Latest updates - Nov 6, 2026: Socket publishes analysis tying strutil-core 1.0.1 to the testmetest worm (Miasma/Shai-Hulud descendant): install-time Bun runner, credential theft, AI-tool poisoning, conditional home-directory wiper on GitHub token revocation, and RubyGems injector identical to the worm's own module output. - Nov 1, 2026: RubyGems account jamnajiea publishes clean strutil-core 1.0.0 (02:19 UTC), then malicious 1.0.1 (04:05 UTC). Socket AI Scanner flags the payload 70 seconds later. RubyGems removes both versions about five hours after the malicious release (~08:52–09:13 UTC per Bitbison). - Oct 31, 2026: Socket: PyPI sibling pystr-codec 0.1.0–0.1.2 appears, using the same paleasbest.top/v1/api collection endpoint (separate build from strutil-core). ## Write-ups & news - [Shai-Hulud Descendant Surfaces in Malicious Ruby Gem That Steals Credentials and Poisons AI Tools](https://socket.dev/blog/shai-hulud-descendant-malicious-ruby-gem) ## Caveats Related npm campaign tracked as testmetest-npm-worm-42-armed-github-repos. Socket has not confirmed victims from this gem. If 1.0.1 was installed, stop net-health-checker / pkg-runtime before revoking GitHub tokens (wiper on 401/403), then rotate credentials from a clean device. --- Machine-readable: https://pwn.watch/i/strutil-core-rubygems-testmetest-worm-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.